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On  the  Title  Page 

Tills  was  the  crew  pafcb  for  STS-107.  The  central  element 
of  the  patch  was  the  microgravity  symbol,  (jg,  flowing  info 
the  rays  of  the  Astronaut  symbol.  The  orbital  inclination  was 
portrayed  by  the  39-degree  angle  of  the  Earth's  horizon  to 
the  Astronaut  symbol.  The  sunrise  was  representative  of  the 
numerous  science  experiments  that  were  the  dawn  of  a  new 
ero  for  confinued  microgrovify  research  on  ffie  /nfernofiona/ 
Space  Station  and  beyond.  The  breadth  of  science  conduct- 
ed on  this  mission  had  widespread  benefits  to  life  on  Earth 
and  the  continued  exploration  of  space,  illustrated  by  the 
Earth  and  stars.  The  constellation  Columba  (the  dove)  was 
chosen  to  symbolize  peace  on  Earth  and  the  Space  Shuttle 
Columbia.  In  addition,  the  seven  sfors  represenf  ffie  STS-107 
crew  members,  as  well  as  honoring  the  original  Mercury  7 
astronauts  who  paved  the  way  to  make  research  in  space 
possible.  The  Israeli  flag  represented  the  First  person  from 
that  country  to  fly  on  the  Space  Shuttle. 


On  the  Back  Cover 

This  emblem  memorializes  the  three  U.S.  human  space  flight 
accidents  -  Apollo  1,  Challenger,  and  Columbia.  The  words 
across  the  top  translate  to:  "To  The  Stars,  Despite  Adversity 
-  Always  Explore" 
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made  to  accomodate  the  new  layout 
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This  cause  of  exploration  and  discovery  is  not  an  option  we  clioose;  it  is  a  desire  written  in  the  human  heart ... 

We  find  the  best  amoni>  us.  send  them  forth  into  unmapped  darkness,  and  pray  they  will  return. 

They  ^o  in  peace  for  all  mankind,  and  all  mankind  is  in  their  debt. 

-  President  George  W.  Bush.  February  4.  2003 


,  pfiofograplied  from  Columbia  on  Jonuory  26,  2003,  during  (he  STS-107  r 
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Board  Statement 


For  all  those  who  are  inspired  by  flight,  and  for  the  nation 
where  powered  flight  was  first  achieved,  the  year  2003  had 
long  been  anticipated  as  one  of  celebration  -  December  1 7 
would  mark  the  centennial  of  the  day  the  Wright  Flyer  first 
took  to  the  air.  But  2003  began  instead  on  a  note  of  sudden 
and  profound  loss.  On  February  1,  Space  Shuttle  Coliimhici 
was  destroyed  in  a  disaster  that  claimed  the  lives  of  all  seven 
of  its  crew. 

While  February  1  was  an  occasion  for  mourning,  the  efforts 
that  ensued  can  be  a  source  of  national  pride.  NASA  publicly 
and  forthrightly  informed  the  nation  about  the  accident  and 
all  the  associated  information  that  became  available.  The  Co- 
lumbia Accident  Investigation  Board  was  established  within 
two  hours  of  the  loss  of  signal  from  the  returning  spacecraft 
in  accordance  with  procedures  established  by  NASA  follow- 
ing the  Challenger  accident  17  years  earlier. 

The  crew  members  lost  that  morning  were  explorers  in  the 
finest  traditiow,  and  since  then,  everyone  associated  with  the 
Board  has  felt  that  we  were  laboring  in  their  legacy.  Ours,  too, 
was  a  journey  of  discovery:  We  sought  to  discover  the  con- 
ditions that  produced  this  tragic  outcome  and  to  share  those 
lessons  in  such  a  way  that  this  nation's  space  program  will 
emerge  stronger  and  more  sure-footed.  If  those  lessons  are 
truly  learned,  then  Columbia's  crew  will  have  made  an  indel- 
ible contribution  to  the  endeavor  each  one  valued  so  greatly. 

After  nearly  seven  months  of  investigation,  the  Board  has 
been  able  to  arrive  at  findings  and  recommendations  aimed 
at  significantly  reducing  the  chances  of  further  accidents. 
Our  aim  has  been  to  improve  Shuttle  safety  by  multiple 
means,  not  just  by  correcting  the  specific  faults  that  cost 
the  nation  this  Orbiter  and  this  crew.  With  that  intent,  the 
Board  conducted  not  only  an  investigation  of  what  happened 
to  ColiiDihia,  but  also  -  to  determine  the  conditions  that  al- 
lowed the  accident  to  occur  -  a  safety  evaluation  of  the  en- 
tire Space  Shuttle  Program.  Most  of  the  Board's  efforts  were 
undertaken  in  a  completely  open  manner.  By  necessity,  the 
safety  evaluation  was  conducted  partially  out  of  the  public 
view,  since  it  included  frank,  off-the-record  statements  by 
a  substantial  number  of  people  connected  with  the  Shuttle 
program. 

In  order  to  understand  the  findings  and  recommendations  in 
this  report,  it  is  important  to  appreciate  the  way  the  Board 
looked  at  this  accident.  It  is  our  view  that  complex  systems 
almost  always  fail  in  complex  ways,  and  we  believe  it  would 
be  wrong  to  reduce  the  complexities  and  weaknesses  asso- 
ciated with  these  systems  to  some  simple  explanation.  Too 
often,  accident  investigations  blame  a  failure  only  on  the 
last  step  in  a  complex  process,  when  a  more  comprehensive 
understanding  of  that  process  could  reveal  that  earlier  steps 
might  be  equally  or  even  more  culpable.  In  this  Board's 
opinion,  unless  the  technical,  organizational,  and  cultural 
recommendations  made  in  this  report  are  implemented,  little 
will  have  been  accomplished  to  lessen  the  chance  that  an- 
other accident  will  follow. 


From  its  inception,  the  Board  has  considered  itself  an  inde- 
pendent and  public  institution,  accountable  to  the  American 
public,  the  White  House.  Congress,  the  astronaut  corps  and 
their  families,  and  N.ASA.  With  the  support  of  these  con.stitu- 
ents,  the  Board  resolved  to  broaden  the  scope  of  the  accident 
investigation  into  a  far-reaching  examination  of  NASA's 
operation  of  the  Shuttle  fleet.  We  have  explored  the  impact 
of  NASA's  organizational  history  and  practices  on  Shuttle 
safety,  as  well  as  the  roles  of  public  expectations  and  national 
policy-making. 

In  this  process,  the  Board  identified  a  number  of  pertinent 
factors,  which  we  have  grouped  into  three  distinct  categories: 
i)  physical  failures  that  led  directly  to  Columbia'?,  destruc- 
tion; 2)  underlying  weaknesses,  revealed  in  NASA's  orga- 
nization and  history,  that  can  pave  the  way  to  catastrophic 
failure;  and  3)  "other  significant  observations"  made  during 
the  course  i)f  the  investigation,  but  which  may  be  unrelated 
to  the  accident  at  hand.  I^eft  uncorrected,  any  of  these  factors 
could  contribute  to  future  Shuttle  losses. 

To  establish  the  credibility  of  its  findings  and  recommenda- 
tions, the  Board  grounded  its  examinations  in  rigorous  sci- 
entific and  engineering  principles.  We  have  consulted  with 
leading  authorities  not  only  in  mechanical  systems,  but  also 
in  organizational  theory  and  practice.  These  authorities'  areas 
of  expertise  included  risk  management,  safety  engineering, 
and  a  review  of  "best  business  practices"  employed  by  other 
high-risk,  but  apparently  reliable  enterprises.  Among  these 
are  nuclear  power  plants,  petrochemical  facilities,  nuclear 
weapons  production,  nuclear  submarine  operations,  and  ex- 
pendable space  launch  systems. 

NASA  is  a  federal  agency  like  no  other.  Its  mission  is 
unique,  and  its  stunning  technological  accomplishments,  a 
source  of  pride  and  inspiration  without  equal,  represent  the 
best  in  American  skill  and  courage.  At  times  NASA's  efforts 
have  riveted  the  nation,  and  it  is  never  far  from  public  view 
and  close  scrutiny  from  many  quarters.  The  loss  oi  Columbia 
and  her  crew  represents  a  turning  point,  calling  for  a  renewed 
public  policy  debate  and  commitment  regarding  human 
space  exploration.  One  of  our  goals  has  been  to  set  forth  the 
terms  for  this  debate. 

Named  for  a  sloop  that  was  the  first  American  vessel  to 
circumnavigate  the  Earth  more  than  200  years  ago,  in  1981 
Columbia  became  the  first  spacecraft  of  its  type  to  fly  in  Earth 
orbit  and  successfully  completed  27  missions  over  more  than 
two  decades.  During  the  STS-107  mission,  Columbia  and  its 
crew  traveled  more  than  six  million  miles  in  16  days. 

The  Orbiter's  destruction,  just  16  minutes  before  .scheduled 
touchdown,  shows  that  space  flight  is  still  far  from  routine. 
It  involves  a  substantial  element  of  risk,  which  must  be 
recognized,  but  never  accepted  with  resignation.  The  seven 
Columbia  astronauts  believed  that  the  risk  was  worth  the 
reward.  The  Board  salutes  their  courage  and  dedicates  this 
report  to  their  memor>'. 
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Executive  Summary 


The  Columbia  Accident  Investigation  Board's  independent 
investigation  into  the  February  1 ,  2003,  loss  of  the  Space 
Shuttle  Colimihia  and  its  seven-member  crew  lasted  nearly 
seven  months.  A  staff  of  more  than  1 20,  along  with  some  400 
NASA  engineers,  supported  the  Board's  13  members.  Inves- 
tigators examined  more  than  30,000  documents,  conducted 
more  than  200  fomial  interviews,  heard  testimony  from 
dozens  of  expert  witnesses,  and  reviewed  more  than  3,000 
inputs  from  the  general  public.  In  addition,  more  than  25.000 
searchers  combed  vast  stretches  of  the  Western  United  States 
to  retrieve  the  spacecraft's  debris.  In  the  process,  Colnnihia's 
tragedy  was  compounded  when  two  debris  searchers  w  ith  the 
U.S.  Forest  Service  perished  in  a  helicopter  accident. 

The  Board  recognized  early  on  that  the  accident  was  prob- 
ably not  an  anomalous,  random  event,  but  rather  likely  root- 
ed to  some  degree  in  NASA's  history  and  the  human  space 
flight  program's  culture.  Accordingly,  the  Board  broadened 
its  mandate  at  the  outset  to  include  an  investigation  of  a  wide 
range  of  historical  and  organizational  issues,  including  polit- 
ical and  budgetary  considerations,  compromises,  and  chang- 
ing priorities  over  the  life  of  the  Space  Shuttle  Program.  The 
Board's  conviction  regarding  the  importance  of  these  factors 
strengthened  as  the  investigation  progressed,  with  the  result 
that  this  report,  in  its  findings,  conclusions,  and  recommen- 
dations, places  as  much  weight  on  these  causal  factors  as  on 
the  more  easily  understood  and  corrected  physical  cause  of 
the  accident. 

The  physical  cause  of  the  loss  of  Coliimhia  and  its  crew  was 
a  breach  in  the  Thermal  Protection  System  on  the  leading 
edge  of  the  left  wing,  caused  by  a  piece  of  insulating  foam 
which  separated  from  the  left  bipod  ramp  section  of  the 
External  Tank  at  81.7  seconds  after  launch,  and  struck  the 
wing  in  the  vicinity  of  the  lower  half  of  Reinforced  Carbon- 
Carbon  panel  number  8.  During  re-entry  this  breach  in  the 
Thermal  Protection  System  allowed  superheated  air  to  pen- 
etrate through  the  leading  edge  insulation  and  progressively 
melt  the  aluminum  structure  of  the  left  wing,  resulting  in 
a  weakening  of  the  structure  until  increasing  aerodynamic 
forces  caused  loss  of  control,  failure  of  the  wing,  and  break- 
up of  the  Orbiter  This  breakup  occuired  in  a  flight  regime  in 
which,  given  the  current  design  of  the  Orbiter,  there  was  no 
possibility  for  the  crew  to  survive. 

The  organizational  causes  of  this  accident  are  rooted  in  the 
Space  Shuttle  Program's  history  and  culture,  including  the 
original  compromises  that  were  required  to  gain  approval  for 
the  Shuttle,  subsequent  years  of  resource  constraints,  fluc- 
tuating priorities,  schedule  pressures,  mischaracterization  of 
the  Shuttle  as  operational  rather  than  developmental,  and  lack 
of  an  agreed  national  vision  for  human  space  flight.  Cultural 
traits  and  organizational  practices  detrimental  to  safety  were 
allowed  to  develop,  including:  reliance  on  past  success  as  a 
substitute  for  sound  engineering  practices  (such  as  testing  to 
understand  why  systems  were  not  performing  in  accordance 
with  requirements);  organizational  barriers  that  prevented 
effective  communication  of  critical  safety  information  and 


stifled  professional  differences  of  opinion;  lack  of  integrated 
management  across  program  elements;  and  the  evolution  of 
an  informal  chain  of  command  and  decision-making  pro- 
cesses that  operated  outside  the  organization's  rules. 

This  report  discusses  the  attributes  of  an  organization  that 
could  more  safely  and  reliably  operate  the  inherently  risky 
Space  Shuttle,  but  does  not  provide  a  detailed  organizational 
prescription.  Among  those  attributes  are:  a  robust  and  in- 
dependent program  technical  authority  that  has  complete 
control  over  specifications  and  requirements,  and  waivers 
to  them;  an  independent  safety  assurance  organization  with 
line  authority  over  all  levels  of  safety  oversight;  and  an  or- 
ganizational culture  that  reflects  the  best  characteristics  of  a 
learning  organization. 

This  report  concludes  with  recommendations,  some  of 
which  are  specifically  identified  and  prefaced  as  "before 
return  to  flight."  These  recommendations  are  largely  related 
to  the  physical  cause  of  the  accident,  and  include  prevent- 
ing the  loss  of  foam,  improved  imaging  of  the  Space  Shuttle 
stack  from  liftoff  through  separation  of  the  External  Tank, 
and  on-orbit  inspection  and  repair  of  the  Thermal  Protec- 
tion System.  The  remaining  recommendations,  for  the  most 
part,  stem  from  the  Board's  findings  on  organizational 
cause  factors.  While  they  are  not  "before  return  to  flight" 
recommendations,  they  can  be  viewed  as  "continuing  to  fly" 
recommendations,  as  they  capture  the  Board's  thinking  on 
what  changes  are  necessary  to  operate  the  Shuttle  and  future 
spacecraft  safely  in  the  mid-  to  long-term. 

These  recommendations  reflect  both  the  Board's  strong  sup- 
port for  return  to  flight  at  the  earliest  date  consistent  with  the 
oveiriding  objective  of  safety,  and  the  Board's  conviction 
that  operation  of  the  Space  Shuttle,  and  all  human  space- 
flight, is  a  developmental  activity  with  high  inherent  risks. 


A  view  from  inside  f/ie  Launch  Control  Center  as  Columbia  rolls  ouf 
fo  Launch  Complex  39-A  on  December  9,  2002. 
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Columbia  sits  on  Launch  Complex  39-A  prior  to  STS107. 
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Report  Synopsis 


The  Columbia  Accident  Investigation  Board's  independent 
investigation  into  the  tragic  February  1 ,  2003.  loss  of"  the 
Space  Shuttle  Coltinihia  and  its  seven-member  crew  lasted 
nearly  seven  months  and  involved  13  Board  members, 
approximately  120  Board  investigators,  and  thousands 
of  NASA  and  support  personnel.  Because  the  events  that 
initiated  the  accident  were  not  apparent  for  some  time, 
the  investigation's  depth  and  breadth  were  unprecedented 
in  NASA  history.  Further,  the  Board  determined  early  in 
the  investigation  that  it  intended  to  put  this  accident  into 
context.  We  considered  it  unlikely  that  the  accident  was  a 
random  event;  rather,  it  was  likely  related  in  some  degree 
to  NASA's  budgets,  histoi^y.  and  program  culture,  as  well 
as  to  the  politics,  compromises,  and  changing  priorities  of 
the  democratic  process.  We  are  convinced  that  the  manage- 
ment practices  overseeing  the  Space  Shuttle  Program  were 
as  much  a  cause  of  the  accident  as  the  foam  that  struck  the 
left  wing.  The  Board  was  also  influenced  by  discussions 
with  members  of  Congress,  who  suggested  that  this  nation 
needed  a  broad  examination  of  NASA's  Human  Space  Flight 
Program,  rather  than  just  an  investigation  into  what  physical 
fault  caused  Coliinihia  to  break  up  during  re-entry. 

Findings  and  recommendations  are  in  the  relevant  chapters 
and  ail  recommendations  are  compiled  in  Chapter  I  1. 

Volume  I  is  organized  into  four  parts:  The  Accident:  Why 
the  Accident  Occurred:  A  Look  Ahead;  and  various  appendi- 
ces. To  put  this  accident  in  context.  Parts  One  and  Twci  begin 
with  histories,  after  which  the  accident  is  described  and  then 
analyzed,  leading  to  findings  and  recommendations.  Part 
Three  contains  the  Board's  views  on  what  is  needed  to  im- 
prove the  safety  of  our  voyage  into  space.  Part  Four  is  refer- 
ence material.  In  addition  to  this  first  volume,  there  will  be 
subsequent  volumes  that  contain  technical  reports  generated 
by  the  Columbia  Accident  Investigation  Board  and  NASA, 
as  well  as  volumes  containing  reference  documentation  and 
other  related  material. 

Part  One:  The  Accident 

Chapter  I  relates  the  history  of  the  Space  Shuttle  Program 
before  the  Cluilleiii;i'r  accident.  With  the  end  looming  for 
the  Apollo  moon  exploration  program,  NASA  unsuccess- 
fully attempted  to  get  approval  for  an  equally  ambitious 
(and  expensive)  space  exploration  program.  Most  of  the 
proposed  programs  started  with  space  stations  in  low-Earth 
orbit  and  included  a  reliable,  economical,  medium-lift 
vehicle  to  travel  safely  to  and  from  low-Earth  orbit.  After 
many  failed  attempts,  and  finally  agreeing  to  what  would 
be  untenable  compromises,  NASA  gained  approval  from  the 
Nixon  Administration  to  develop,  on  a  hxed  budget,  only 
the  transport  vehicle.  Because  the  Administration  did  not  ap- 
prove a  low-Earth-orbit  station,  NASA  had  to  create  a  mis- 
sion for  the  vehicle.  To  satisfy  the  Administration's  require- 
ment that  the  system  be  economically  justifiable,  the  vehicle 
had  to  capture  essentially  all  space  launch  business,  and  to 
do  that,  it  had  to  meet  wide-ranging  requirements.  These 


sometimes-competing  requirements  resulted  in  a  compro- 
mise vehicle  that  was  less  than  optimal  for  manned  flights. 
NASA  designed  and  developed  a  remarkably  capable  and 
resilient  vehicle,  consisting  of  an  Orbiter  with  three  Main 
Engines,  two  Solid  Rocket  Boosters,  and  an  External  Tank, 
but  one  that  has  never  met  any  of  its  original  requirements 
for  reliability,  cost,  ease  of  turnaround,  maintainability,  or, 
regrettably,  safety. 

Chapter  2  documents  the  final  flight  of  Coliinihia.  As  a 
straightforward  record  of  the  event,  it  contains  no  findings  or 
recommendations.  Designated  STS-107,  this  was  the  Space 
Shuttle  Program's  113th  flight  and  Coliiiiihia's.  28th.  The 
flight  was  close  to  trouble-free.  Unfortunately,  there  were  no 
indications  to  either  the  crew  onboard  Coliinihia  or  to  engi- 
neers in  Mission  Control  that  the  mission  was  in  trouble  as 
a  result  of  a  foam  strike  during  ascent.  Mission  management 
failed  to  detect  weak  signals  that  the  Orbiter  was  in  trouble 
and  take  corrective  actitin. 

Coliinihia  was  the  first  space-rated  Orbiter  It  made  the  Space 
Shuttle  Program's  first  four  orbital  test  flights.  Because  it  was 
the  first  of  its  kind,  Coliinihia  differed  slightly  from  Orbiters 
Clialleiificr.  Dixcoven\  Atlantis,  and  Endeavour.  Built  to  an 
earlier  engineering  standard,  Coliinihia  was  slightly  heavier, 
and,  although  it  could  reach  the  high-inclination  orbit  of  the 
International  Space  Station,  its  payload  was  insufficient  to 
make  Coliinihia  cost-effective  for  Space  Station  missions. 
Therefore.  Coliinihia  was  not  equipped  with  a  Space  Station 
docking  system,  which  freed  up  space  in  the  payload  bay  for 
longer  cargos,  such  as  the  science  modules  Spacelab  and 
SPACEHAB.  Consequently,  Coliinihia  generally  flew  sci- 
ence missions  and  serviced  the  Hubble  Space  Telescope. 

STS-107  was  an  intense  science  mission  that  required  the 
seven-member  crew  to  form  two  teams,  enabling  round- 
the-clock  shifts.  Because  the  extensive  science  cargo  and 
its  extra  power  sources  required  additional  checkout  time, 
the  launch  sequence  and  countdown  were  about  24  hours 
longer  than  normal.  Nevertheless,  the  countdown  proceeded 
as  planned,  and  Coliinihia  was  launched  from  Launch  Com- 
plex 39-Aon  January  16,  2003,  at  10:39  a.m.  Eastern  Stan- 
dard Time  (EST). 

At  81.7  seconds  after  launch,  when  the  Shuttle  was  at  about 
65,820  feet  and  traveling  at  Mach  2.46  ( 1 ,6.50  mph),  a  large 
piece  of  hand-crafted  insulating  foam  came  off  an  area 
where  the  Orbiter  attaches  to  the  External  Tank.  At  81.9 
seconds,  it  struck  the  leading  edge  of  Colnnihia's  left  wing. 
This  event  was  not  detected  by  the  crew  on  board  or  seen 
by  ground  support  teams  until  the  next  day,  during  detailed 
reviews  of  all  launch  camera  photography  and  videos.  This 
foam  strike  had  no  apparent  effect  on  the  daily  conduct  of 
the  16-day  mission,  which  met  all  its  objectives. 

The  de-orbit  burn  to  slow  Coliinihia  down  for  re-entry 
into  Earth's  atmosphere  was  nomial,  and  the  flight  profile 
throughout  re-entry  was  standard.  Time  dining  re-entry  is 
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measured  in  seconds  from  "Entry  Interface,"  an  arbitrarily 
determined  altitude  of  400,000  feet  where  the  Orbiter  be- 
gins to  experience  the  effects  of  Earth's  atmosphere.  Entry 
Interface  for  STS-107  occurred  at  8:44:09  a.m.  on  February 
i.  Unknown  to  the  crew  or  ground  personnel,  because  the 
data  is  recorded  and  stored  in  the  Orbiter  instead  of  being 
transmitted  to  Mission  Control  at  Johnson  Space  Center,  the 
first  abnormal  indication  occurred  270  seconds  after  Entry 
Interface.  Chapter  2  reconstructs  in  detail  the  events  lead- 
ing to  the  loss  of  Coliii7ihia  and  her  crew,  and  refers  to  more 
details  in  the  appendices. 

In  Chapter  3,  the  Board  analyzes  all  the  information  avail- 
able to  conclude  that  the  direct,  physical  action  that  initiated 
the  chain  of  events  leading  to  the  loss  of  Coliinihia  and  her 
crew  was  the  foam  strike  during  ascent.  This  chapter  re- 
views five  analytical  paths  -  aerodynamic,  thermodynamic, 
sensor  data  timeline,  debris  reconstruction,  and  imaging 
evidence  -  to  show  that  all  five  independently  arrive  at  the 
same  conclusion.  The  subsequent  impact  testing  conducted 
by  the  Board  is  also  discussed. 

That  conclusion  is  that  Coliinihia  re-entered  Earth's  atmo- 
sphere with  a*  pre-existing  breach  in  the  leading  edge  of  its 
left  wing  in  the  vicinity  of  Reinforced  Carbon-Carbon  (RCC) 
panel  8.  This  breach,  caused  by  the  foam  strike  on  ascent, 
was  of  sufficient  size  to  allow  superheated  air  (probably  ex- 
ceeding 5,000  degrees  Fahrenheit)  to  penetrate  the  cavity  be- 
hind the  RCC  panel.  The  breach  widened,  destroying  the  in- 
sulation protecting  the  wing's  leading  edge  support  structure, 
and  the  superheated  air  eventually  melted  the  thin  aluminum 
wing  spar.  Once  in  the  interior,  the  superheated  air  began  to 
destroy  the  left  wing.  This  destructive  process  was  carefully 
reconstructed  from  the  recordings  of  hundreds  of  sen.sors  in- 
side the  wing,  and  from  analyses  of  the  reactions  of  the  flight 
control  systems  to  the  changes  in  aerodynamic  forces. 

By  the  time  Coliinihia  passed  over  the  coast  of  California 
in  the  pre-dawn  hours  of  February  I,  at  Entry  Interface  plus 
555  seconds,  amateur  videos  show  that  pieces  of  the  Orbiter 
were  shedding.  The  Orbiter  was  captured  on  videotape  dur- 
ing most  of  its  quick  transit  over  the  Western  United  States. 
The  Board  correlated  the  events  seen  in  these  videos  to 
sensor  readings  recorded  during  re-entry.  Analysis  indi- 
cates that  the  Orbiter  continued  to  fly  its  pre-planned  flight 
profile,  although,  still  unknown  to  anyone  on  the  ground  or 
aboard  Coliinihia,  her  control  systems  were  working  furi- 
ously to  maintain  that  flight  profile.  Finally,  over  Texas,  just 
southwest  of  Dallas-Fort  Worth,  the  increasing  aerodynamic 
forces  the  Orbiter  experienced  in  the  denser  levels  of  the  at- 
mosphere overcame  the  catastrophically  damaged  left  wing, 
causing  the  Orbiter  to  fall  out  of  control  at  speeds  in  excess 
of  10,000  mph. 

The  chapter  details  the  recovery  of  about  38  percent  of  the 
Orbiter  (some  84,000  pieces)  and  the  reconstruction  and 
analysis  of  this  debris.  It  presents  findings  and  recommenda- 
tions to  make  future  Space  Shuttle  operations  safer. 

Chapter  4  describes  the  investigation  into  other  possible 
physical  factors  that  may  have  contributed  to  the  accident. 
The  chapter  opens  with  the  methodology  of  the  fault  tree 


analysis,  which  is  an  engineering  tool  for  identifying  every 
conceivable  fault,  then  detennining  whether  that  fault  could 
have  caused  the  system  in  question  to  fail.  In  all,  more  than 
3,000  individual  elements  in  the  Coliinihia  accident  fault 
tree  were  examined. 

In  addition,  the  Board  analyzed  the  more  plausible  fault  sce- 
narios, including  the  impact  of  space  weather,  collisions  with 
micrometeoroids  or  "space  junk,"  willful  damage,  flight  crew 
performance,  and  failure  of  some  critical  Shuttle  hardware. 
The  Board  concludes  in  Chapter  4  that  despite  certain  fault 
tree  exceptions  left  "open"  because  they  cannot  be  conclu- 
sively disproved,  none  of  these  factors  caused  or  contributed 
to  the  accident.  This  chapter  also  contains  findings  and  rec- 
ommendations to  make  Space  Shuttle  operations  safer. 

Part  Two:  Why  the  Accident  Occurred 

Part  Two,  "Why  the  Accident  Occurred,"  examines  NASA's 
organizational,  historical,  and  cultural  factors,  as  well  as 
how  these  factors  contributed  to  the  accident. 

As  in  Part  One,  Part  Two  begins  with  history.  Chapter  5 
examines  the  posl-Challeni^er  history  of  NASA  and  its 
Human  Space  Flight  Program.  A  summary  of  the  relevant 
portit)ns  of  the  Challeiii>er  investigation  recommendations 
is  pre.sented.  followed  by  a  review  of  N./KSA  budgets  to  indi- 
cate how  committed  the  nation  is  to  supporting  human  space 
flight,  and  within  the  NASA  budget  we  look  at  how  the 
Space  Shuttle  Program  has  fared.  Next,  organizational  and 
management  history,  such  as  shifting  management  systems 
and  locations,  are  reviewed. 

Chapter  6  documents  management  performance  related  to 
Coliinihia  to  establish  events  analyzed  in  later  chapters.  The 
chapter  begins  with  a  review  of  the  history  of  foam  strikes  on 
theOrbitertodeterminehow  Space  Shuttle  Program  managers 
rationalized  the  danger  from  repeated  strikes  on  the  Or- 
biter's  Thermal  Protection  System.  Next  is  an  explanation 
of  the  intense  pressure  the  program  was  under  to  stay  on 
schedule,  driven  largely  by  the  self-imposed  requirement  to 
complete  the  International  Space  Station.  Chapter  6  then  re- 
lates in  detail  the  effort  by  some  NASA  engineers  to  obtain 
additional  imagery  of  Coliinihia  to  determine  if  the  foam 
strike  had  damaged  the  Orbiter.  and  how  management  dealt 
with  that  effort. 

In  Chapter  7,  the  Board  presents  its  view  that  NASA's  or- 
ganizational culture  had  as  much  to  do  with  this  accident 
as  foam  did.  By  examining  safety  history,  organizational 
theory,  best  business  practices,  and  current  safety  failures, 
the  report  notes  that  only  significant  structural  changes  to 
NASA's  organizational  culture  will  enable  it  to  succeed. 

This  chapter  measures  the  Shuttle  Program's  practices 
against  this  organizational  context  and  finds  them  wanting. 
The  Board  concludes  that  NASA's  current  organization 
does  not  provide  effective  checks  and  balances,  does  not 
have  an  independant  safety  program,  and  has  not  dem- 
onstrated the  characteristics  of  a  learning  organization. 
Chapter  7  provides  recommendations  tor  adjustments  in 
orsanizational  culture. 
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Chapter  8,  the  final  chapter  in  Part  Two,  draws  from  the 
previous  chapters  on  history,  budgets,  culture,  organization, 
and  safety  practices,  and  analyzes  how  all  these  factors  con- 
tributed to  this  accident.  The  chapter  opens  with  "echoes  of 
Challeiific'r"  that  compares  the  two  accidents.  This  chapter 
captures  the  Board's  views  of  the  need  to  adjust  manage- 
ment to  enhance  safety  margins  in  Shuttle  operations,  and 
reaffirms  the  Board's  position  that  without  these  changes, 
we  have  no  confidence  that  other  "corrective  actions"  will 
improve  the  safety  of  Shuttle  operations.  The  changes  we 
recommend  will  be  difficult  to  accomplish  -  and  will  be 
internally  resisted. 

Part  Three:  A  Look  Ahead 

Part  Three  summarizes  the  Board's  conclusions  on  what 
needs  to  be  done  to  resume  our  journey  into  space,  lists 
significant  observations  the  Board  made  that  are  unrelated 
to  the  accident  but  should  be  recorded,  and  provides  a  sum- 
mary of  the  Board's  recommendations. 

In  Chapter  9,  the  Board  first  reviews  its  short-term  recom- 
mendations. These  return-to-flight  recommendations  are  the 
minimum  that  must  be  done  to  essentially  li\  the  problems 
that  were  identified  by  this  accident.  Next,  the  report  dis- 
cusses what  needs  to  be  done  to  operate  the  Shuttle  in  the 
mid-term,  3  to  15  years.  Based  on  NASA's  history  of  ignor- 
ing external  recommendations,  or  making  improvements 
that  atrophy  with  time,  the  Board  has  no  confidence  that  the 
Space  Shuttle  can  be  safely  operated  for  more  than  a  few 
years  based  solely  on  renewed  post-accident  vigilance. 

Chapter  9  then  outlines  the  management  system  changes  the 
Board  feels  are  necessary  to  safely  operate  the  Shuttle  in  the 
mid-term.  These  changes  separate  the  management  of  sched- 
uling and  budgets  from  technical  specification  authority, 
build  a  capability  of  systems  integration,  and  establish  and 
provide  the  resources  for  an  independent  safety  and  mission 
assurance  organization  that  has  supervisory  authority.  The 
third  part  of  the  chapter  discusses  the  poor  record  this  na- 
tion has,  in  the  Board's  view,  of  developing  either  a  comple- 
ment to  or  a  replacement  for  the  Space  Shuttle.  The  report  is 
critical  of  several  bodies  in  the  U.S.  government  that  share 
responsibility  for  this  situation,  and  expresses  an  opinion  on 
how  to  proceed  from  here,  but  does  not  suggest  what  the  next 
vehicle  should  look  like. 

Chapter  10  contains  findings,  observations,  and  recom- 
mendations that  the  Board  developed  over  the  course  of  this 
extensive  investigation  that  are  not  directly  related  to  the 
accident  but  should  prove  helpful  to  NASA. 

Chapter  1 1  is  a  compilation  of  all  the  recommendations  in 
the  previous  chapters. 

Part  Four:  Appendices 

Part  Four  of  the  report  by  the  Columbia  Accident  Inves- 
tigation Board  contains  material  relevant  to  this  volume 
organized  in  appendices.  Additional,  stand-alone  volumes 
will  contain  more  reference,  background,  and  analysis  ma- 
terials. 


This  Earfh  view  of  the  Sinai  Peninsula,  Red  Sea,  Egypt,  Nile  River, 
and  the  Mediterranean  was  taken  from  Columbia  during  STS107. 
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An  Introduction  to  the  Space  Shuhle 


The  Space  Shuttle  is  one  of  the  most  complex  machines  ever 
devised.  Its  main  elements  -  the  Orbiter.  Space  Shuttle  Main 
Engines,  External  Tank,  and  Solid  Rocket  Boosters  -  are  assembled 
from  more  than  2.5  million  parts,  230  miles  of  wire,  1,060  valves, 
and  1,440  circuit  breakers.  Weighing  approximately  4.5  million- 
pounds  at  launch,  the  Space  Shuttle  accelerates  to  an  orbital 
velocity  of  17,500  miles  per  hour  -  25  times  faster  than  the  speed 
of  sound  -  in  just  over  eight  minutes.  Once  on  orbit,  the  Orbiter 
must  protect  its  crew  from  the  vacuum  of  space  while  enabling 
astronauts  to  conduct  scientific  research,  deploy  and  service 
satellites,  and  assemble  the  Inlernational  Space  Station.  At  the  end 
of  its  mission,  the  Shuttle  uses  the  Earth's  atmosphere  as  a  brake  lo 
decelerate  from  orbital  velocity  to  a  safe  landing  at  220  miles  per 
hour,  dissipating  in  the  process  all  the  energy  it  gained  on  its  way 
into  orbit. 

The  Orbiter 

The  Orbiter  is  what  is  popularly  refen-ed  to  as  "the  Space  Shuttle." 
About  the  size  of  a  small  commercial  airliner,  the  Orbiter  nonnally 
carries  a  crew  of  seven,  including  a  Commander,  Pilot,  and  five 
Mission  or  Payload  Specialists.  The  Orbiter  can  accommodate  a 
payload  the  size  of  a  school  bus  weighing  between  .38,000  and 
56,300  pounds  depending  on  what  orbit  it  is  launched  into,  fhc 
Orbiter's  upper  flight  deck  is  filled  with  equipment  for  flying  and 
maneuvering  the  vehicle  and  controlling  its  remote  manipulator 
arm.  The  mid-deck  contains  stowage  lockers  for  food,  equipment, 
supplies,  and  experiments,  as  well  as  a  toilet,  a  hatch  for  entering 
and  exiting  the  vehicle  on  the  ground,  and  -  in  some  instances  -  an 
airlock  for  doing  so  in  orbit.  During  liftoff  and  landing,  four  crew 
members  sit  on  the  flight  deck  and  the  rest  on  the  mid-deck. 
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Different  pails  of  the  Orbiter  are  subjected  to  dramatically  different 
temperatures  during  re-entry.  The  nose  and  leading  edges  of  the 
wings  are  exposed  to  superheated  air  temperatures  of  2,800  to  3,000 
degrees  Fahrenheit,  depending  upon  re-entry  profile.  Other  portions 
of  the  wing  and  fuselage  can  reach  2,300  degrees  Fahrenheit.  Still 
other  areas  on  top  of  the  fuselage  are  sufficiently  shielded  from 
superheated  air  that  ice  sometimes  survives  through  landing. 

To  protect  its  thin  aluminum  structure  during  re-entry,  the  Orbiter 
is  covered  with  various  materials  collectively  referred  to  as  the 
Thermal  Protection  System.  The  three  major  components  of  the 
system  are  various  types  of  heat-resistant  tiles,  blankets,  and  the 
Reinforced  Carbon-Carbon  (RCC)  panels  on  the  leading  edge  of 
the  wing  and  nose  cap.  The  RCC  panels  most  closely  resemble  a 
hi-tech  fiberglass  -  layers  of  special  graphite  cloth  that  are  molded 


to  the  desired  shape  at  ver>  high  temperatures.  The  tiles,  which 
protect  most  other  areas  of  the  Orbiter  exposed  to  medium  and 
high  heating,  are  90  percent  air  and  10  percent  silica  (similar  to 
common  sand).  One-tenth  the  weight  of  ablative  heat  shields, 
which  are  designed  to  erode  during  re-entry  and  therefore  can  only 
be  used  once,  the  Shuttle's  tiles  are  reusable.  They  come  in  varying 
strengths  and  sizes,  depending  on  which  area  of  the  Orbiter  they 
protect,  and  are  designed  to  withstand  either  1 ,200  or  2.300  degrees 
Fahrenheit.  In  a  dramatic  demonstration  of  how  little  heat  the  tiles 
transfer,  one  can  place  a  blowtorch  on  one  side  of  a  tile  and  a  bare 
hand  on  the  other.  The  blankets,  capable  of  withstanding  either 
700  or  1,200  degrees  Fahrenheit,  cover  regions  of  the  Orbiter  that 
experience  only  moderate  heating. 

Space  Shuhle  Main  Engines 


Each  Orbiter  has  three  main  engines  mounted  at  the  aft  fuselage. 
These  engines  use  the  most  efficient  propellants  in  the  world 
-  oxygen  and  liydrogen  -  at  a  rate  of  half  a  ton  per  second.  At  100 
percent  power,  each  engine  produces  375,000  pounds  of  thrust, 
four  times  that  of  the  largest  engine  on  commercial  jets.  The  large 
bell-shaped  nozzle  on  each  engine  can  swivel  10.5  degrees  up  and 
down  and  8.5  degrees  left  and  right  to  provide  steering  control 
during  ascent. 

External  Tank 

The  three  main  engines  burn  propellant  at  a  rate  that  would  drain 
an  average-size  swimming  pool  in  20  seconds.  The  External 
Tank  accommodates  up  to  143,351  gallons  of  liquid  oxygen  and 
385.265  gallons  of  liquid  hydrogen.  In  order  to  keep  the  super-cold 
propellants  from  boiling  and  to  prevent  ice  from  forming  on  the 
outside  of  the  tank  while  it  is  sitting  on  the  launch  pad.  the  External 
Tank  is  covered  with  a  one-inch-thick  coating  of  insulating  foam. 
This  insulation  is  so  effective  that  the  surface  of  the  External  Tank 
feels  only  slightly  cool  to  the  touch,  even  though  the  liquid  oxygen 
is  stored  at  minus  297  degrees  Fahrenheit  and  liquid  hydrogen 
at  minus  423  degrees  Fahrenheit,  fhis  insulating  foam  also 
protects  the  tank's  aluminum  structure  from  aerodynamic  heating 
during  ascent.  Although  generally  considered  the  least  complex 
of  the  Shuttle's  main  components,  in  fact  the  External  Tank  is  a 
remarkable  engineering  achievement.  In  addition  to  holding  over 
1.5  million  pounds  of  cryogenic  propellants,  the  153.8-foot  long 
tank  must  support  the  weight  of  the  Orbiter  while  on  the  launch  pad 
and  absorb  the  7.3  million  pounds  of  thrust  generated  by  the  Solid 
Rocket  Boosters  and  Space  Shuttle  Main  Engines  during  launch  and 
ascent.  The  External  Tanks  are  manufactured  in  a  plant  near  New 
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Orleans  and  are  transported  by  barge  to  the  Kennedy  Space  Center 
in  Florida.  Unlike  the  Solid  Rocket  Boosters,  w  hich  are  reused,  the 
External  Tank  is  discarded  during  each  mission,  burning  up  in  the 
Earth's  atmosphere  alter  being  jettisoned  from  the  Orbiter. 

Solid  Rocket  Boosters 

Despite  their  power,  the  Space  Shuttle  Main  Engines  alone  are  not 
sufficient  to  boost  the  vehicle  to  orbit  -  in  lact.  they  provide  only  1 5 
percent  of  the  necessary  thrust.  Two  Solid  Rocket  Boosters  attached 
to  the  External  Tank  generate  the  remaining  S.'S  percent.  Together, 
these  two  149-foot  long  motors  produce  over  six  million  pounds  of 
thrust.  The  largest  solid  propellant  rockets  ever  flown,  these  motors 
use  an  aluminum  powder  fuel  and  ammonium  perchlorate  oxidizer 
in  a  binder  that  has  the  feel  and  consistency  of  a  pencil  eraser. 


m 


A  Solid  Rocket  Booster  (SRB)  Demonstration  Motor  being  tested 
near  Brigham  City,  Utah. 


Eiach  of  the  Solid  Rocket  Boosters  consists  of  1 1  separate  segments 
joined  together.  The  joints  between  the  segments  were  extensively 
redesigned  after  the  Cludlenf>er  accident,  w hich  occurred  when  hot 
ga.ses  burned  through  an  O-ring  and  .seal  in  the  aft  joint  on  the  left 
Solid  Rocket  Booster.  The  motor  segments  are  shipped  from  their 
manufacturer  in  Utah  and  assembled  at  the  Kennedy  Space  Center. 
Once  assembled,  each  Solid  Rocket  Booster  is  connected  to  the 
External  Tank  by  bolts  weighing  65  pounds  each.  After  the  Solid 
Rocket  Boosters  burn  for  just  over  two  minutes,  these  bolts  are 
separated  by  pyrotechnic  charges  and  small  rockets  then  push  the 
Solid  Rocket  Biwsters  safely  away  from  the  rest  of  the  vehicle.  As 
the  boosters  fall  back  to  liarlh,  parachutes  in  their  nosecones  deploy. 
After  splashing  down  into  the  ocean  1 20  miles  downrange  from  the 
launch  pad.  they  arc  recovered  for  refurbishment  and  reuse. 


The  Shuhle  Stack 

The  lirsl  step  in  assembling  a  Space  Shuttle  for  launch  is  stacking 
the  Solid  Rocket  Booster  segments  on  the  Mobile  Launch 
Platform.  Eight  large  hold-down  bolts  at  the  base  of  the  Solid 
Rocket  Boosters  will  bear  the  weight  of  the  entire  Space  Shuttle 
stack  while  it  awaits  launch.  The  External  Tank  is  attached  to 
the  Solid  Rocket  Boosters,  and  the  Orbiter  is  then  attached  to  the 
External  Tank  at  three  points  -  two  at  its  bottom  and  a  "bipod" 
attachment  near  the  nose.  When  the  vehicle  is  ready  to  move  out  of 
the  Vehicle  Assembly  Building,  a  Crawler-Transporter  picks  up  the 
entire  Mobile  Launch  Platform  and  carries  it  -  at  one  mile  per  hour 
-  to  one  of  the  two  launch  pads. 
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An  Introduction  to  NASA 


■'An  Act  to  provide  for  research  into  the  problems  of  flight  within 
and  outside  the  Etirlh's  atmosphere,  and  for  other  purposes."  With 
this  simple  preamble,  the  Congress  and  the  President  of  the  United 
States  created  the  National  Aeronautics  and  Space  Administration 
(NASA)  on  October  1,  1958.  Formed  in  response  to  the  launch  of 
Sputnik  by  the  Soviet  Union,  N.ASA  inherited  the  research-oriented 
National  Advisory'  Committee  for  Aeronautics  (NACA)  and  several 
other  government  organizations,  and  almost  immediately  began 
working  on  options  for  manned  space  flight.  NASA's  first  high 
profile  program  was  Project  Merctny.  an  early  effort  to  learn  if  hu- 
mans could  survive  in  space.  Project  Gemini  followed  with  a  more 
complex  series  of  experiments  to  increase  man's  time  in  space  and 
validate  advanced  concepts  such  as  rendezvous.  The  efforts  con- 
tinued with  Project  Apollo,  culminating  in  1969  when  Apollo  II 
landed  the  first  humans  on  the  Moon.  The  return  from  orbit  on  July 
24,  1975,  of  the  crew  from  the  Apollo-Soyuz  Test  Project  began 
a  six-year  hiatus  of  American  manned  space  flight.  The  launch  of 
the  first  Space  Shuttle  in  April  1981  brought  Americans  back  into 
space,  continuing  today  w  ith  the  assembly  and  initial  operations  of 
the  international  Space  Station. 

In  addition  to  the  human  space  flight  program,  NASA  also  main- 
tains an  active  (if  small)  aeronautics  research  program,  a  space 
science  progrsfm  (including  deep  space  and  interplanetary  explora- 
tion), and  an  Earth  observation  program.  The  agency  also  conducts 
basic  research  activities  in  a  variety  of  fields. 

NASA,  like  many  federal  agencies,  is  a  heavily  matrixed  organiza- 
tion, meaning  that  the  lines  of  authority  are  not  necessarily  straight- 
forward. At  the  simplest  level,  there  are  three  major  types  of  entities 
involved  in  the  Human  Space  Flight  Program:  NASA  field  centers, 
NASA  programs  carried  out  at  those  centers,  and  industrial  and 
academic  contractors.  The  centers  provide  the  buildings,  facilities, 
and  support  services  for  the  various  programs.  The  programs,  along 
with  field  centers  and  Headquarters,  hire  civil  servants  and  contrac- 
tors from  the  private  sector  to  support  aspects  of  their  enterprises. 
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The  Locations 


NASA  Headc|uarters,  located  in  Washington  U.C,  is  responsit 
leadership  and  management  across  five  strategic  enterprises:  Aero- 
space Technology,  Biological  and  Physical  Research.  Earth  Science, 
Space  Science,  and  Human  Exploration  and  Development  of  Space. 
NASA  Headquarters  also  provides  strategic  management  for  the 
Space  Shuttle  and  International  Space  Station  programs. 

The  Johnson  Space  Center  in  Houston,  Texas,  was  established  in 
1961  as  the  Manned  Spacecraft  Center  and  has  led  the  development 
of  every  U.S.  manned  space  flight  program.  Currently,  Johnson  is 
home  to  both  the  Space  Shuttle  and  International  Space  Station  Pro- 
gram Offices.  The  facilities  at  Johnson  include  the  training,  simula- 
tion, and  mission  control  centers  for  the  Space  Shuttle  and  Space 
Station.  Johnson  also  has  flight  operations  at  Ellington  Field,  where 
the  training  aircraft  for  the  astronauts  and  support  aircraft  for  the 
Space  Shuttle  Program  are  stationed,  and  manages  the  White  Sands 
Test  Facility,  New  Mexico,  where  hazardous  testing  is  conducted. 

The  Kennedy  Space  Center  was  created  to  launch  the  Apollo  mis- 
sions to  the  Moon,  and  currently  provides  launch  and  landing  facili- 
ties for  the  Space  Shuttle.  The  Center  is  located  on  Merritt  Island. 
Florida,  adjacent  to  the  Cape  Canaveral  Air  Force  Station  that  also 
provides  support  for  the  Space  Shuttle  Program  (and  was  the  site 
of  the  earlier  Mercury  and  Gemini  launches).  Personnel  at  Ken- 
nedy support  maintenance  and  overhaul  services  for  the  Orbiters, 
assemble  and  check-out  the  integrated  vehicle  prior  to  launch,  and 
operate  the  Space  Station  Processing  Facility  where  components  of 
the  orbiting  laboratory  are  packaged  for  launch  aboard  the  Space 
Shuttle.  The  majority  of  contractor  personnel  assigned  to  Kennedy 
are  part  of  the  Space  Flight  Operations  Contract  administered  by 
the  Space  Shuttle  Program  Office  at  Johnson. 

riie  Marshall  Space  Flight  Center,  near  Hunslville,  Alabama,  is 
home  to  most  NASA  rocket  propulsion  efforts.  The  Space  Shuttle 

Projects  Office  located  at 
Marshall  —organization- 
ally part  of  the  Space 
Shuttle  Program  Office 
at  Johnson— manages  the 
manufacturing  and  support 
contracts  to  Boeing  Rock- 
etdyne  for  the  Space  Shut- 
tle Main  Engine  (SSME), 
to  Eockheed  Martin  for  the 
External  Tank  (ET).  and  to 
ATK  Ihiokol  Propulsion 
for  the  Reusable  Solid 
Rocket  Motor  (RSRM.  the 
major  piece  of  the  Solid 
Rocket  Booster).  Marshall 
is  also  involved  in  micro- 
gravity  research  and  space 
product  development  pro- 
grams that  fly  as  payloads 
on  the  Space  Shuttle. 
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The  Stennis  Space  Center 
in  Bay  St.  Louis,  Missis- 
sippi, is  the  largest  rocket 
propulsion  test  complex  in 
ihe  United  States.  Stennis 
provides  all  of  the  testing 
facilities    for    the    Space 
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Shuttle  Main  Engines  and  External 
Tank.  (The  Solid  Rocket  Boosters  are 
tested  at  the  ATK  Thiokol  Propulsion 
facilities  in  Utah.) 

The  Ames  Research  Center  at  Moffett 
Field.  California,  has  evolved  from  its 
aeronautical  research  roots  to  become 
a  Center  of  Excellence  for  information 
technology.  The  Center's  primary  im- 
portance to  the  Space  Shuttle  Program, 
however,  lies  in  wind  tunnel  and  arc -jet 
testing,  and  the  development  of  thermal 
protection  system  concepts. 
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The  Langley  Research  Center,  at  Hamp- 
ton, Virginia,  is  the  agency's  primary 
center  for  structures  and  materials  and 
supports  the  Space  Shuttle  Program  in 
these  areas,  as  v\ell  as  in  basic  aerody- 
namic and  thermodynamic  research. 

The  Programs 

The  two  major  human  space  flight  ef- 
forts within  NASA  are  the  Space  Shut- 
tle Program  and  International  Space 
Station  Program,  both  headquartered  at 
Johnson  although  they  re|X)rt  to  a  Dep- 
uty Associate  Administrator  at  NASA 
Headquarters  in  Washington.  D.C. 


The  Space  Shuttle  Program  Office  at 
Johnson  is  responsible  for  all  aspects 
of  developing,  supporting,  and  flying 
the  Space  Shuttle.  To  accomplish  these 
tasks,  the  program  maintains  large 
workforces  at  the  various  NASA  Cen- 
ters that  host  the  facilities  used  by  the  program.  The  Space  Shuttle 
Program  Office  is  also  responsible  for  managing  the  Space  Flight 
Operations  Contract  with  United  Space  Alliance  that  provides  most 
of  the  contractor  support  at  Johnson  and  Kennedy,  as  well  as  a  small 
amoiml  at  Marshall. 

The  Contractors 

The  Space  Shuttle  Program  employs  a  wide  variel)  of  commercial 
companies  to  provide  services  and  products.  Among  the.se  are  some 
of  the  largest  aerospace  and  defense  contractors  in  the  counti7,  in- 
cluding (but  not  limited  to): 

United  Space  Alliance 

This  is  a  joint  venture  between  Boeing  and  Lockheed  Martin  that 
was  established  in  1996  to  perform  the  Space  Flight  Operations 
Contract  that  essentially  conducts  the  day-to-day  operation  of  the 
Space  Shuttle.  United  Space  Alliance  is  headquartered  in  Houston. 
Texas,  and  employs  more  than  10.000  people  at  Johnson,  Kennedv, 
and  Marshall.  Its  contract  currently  runs  through  2005. 

The  Boeing  Company,  NASA  Systems 

The  Space  Shuttle  Orbiter  was  designed  and  manufactured  by 
Rockwell  International,  located  primarily  in  Downey  and  Palmdale. 
California.  In  1996.  The  Boeing  Company  purchased  the  aerospace 
assets  of  Rockwell  International,  and  later  moved  the  Downey  op- 
eration to  Huntington  Beach.  California,  as  part  of  a  consolidation 
of  facilities.  Boeing  is  subcontracted  lo  United  Space  Alliance  to 
provide  support  to  Orbiter  modifications  and  operations,  with  work 
performed  in  California,  and  at  Johnson  and  Kennedy. 
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The  Boeing  Company,  Rocketdyne  Propulsion  &  Power 

The  Rocketdjne  Division  ttf  Rockwell  International  was  responsi- 
ble lor  the  development  and  manufacture  of  the  Space  Shuttle  Main 
Engines,  and  continues  to  support  the  engines  as  a  part  of  The  Boe- 
ing Company.  The  Space  Shuttle  Projects  Office  at  Marshall  man- 
ages the  main  engines  contract,  with  most  of  the  work  performed  in 
California,  Stennis,  and  Kennedy. 

ATK  Thiokol  Propulsion 

ATK  Thiokol  Propulsion  (formerly  Morton-Thiokol)  in  Brigham 
City,  Utah,  manufactures  the  Reusable  Solid  Rocket  Motor  seg- 
ments that  are  the  propellant  sections  of  the  Solid  Rocket  Boosters. 
The  Space  Shuttle  Projects  Office  at  Marshall  manages  the  Reus- 
able Solid  Rocket  Motor  contract. 

Lockheed  Martin  Space  Systems,  Michoud  Operations 

The  External  lank  was  developed  and  manufactured  by  Martin 
Marietta  at  the  NASA  Michoud  Assembly  Facility  near  New  Or- 
leans. Louisiana.  Martin  Marietta  later  merged  with  Lockheed  to 
create  Lockheed  Martin.  The  External  Tank  is  the  only  disposable 
part  of  the  Space  Shuttle  system,  .so  new  ones  are  always  under 
construction.  The  Space  Shuttle  Projects  Office  at  Marshall  man- 
ages the  External  Tank  contract. 

Lockheed  Martin  Missiles  and  Fire  Control 

The  Reinforced  Carbon-Carbon  (RCC)  panels  used  on  the  nose 
and  wing  leading  edges  of  the  Orbiter  were  manufactured  by  Ling- 
Temco-Vought  in  Grand  Prairie.  Fcxas.  Lockheed  Martin  acquired 
LTV  through  a  series  of  mergers  and  acquisitions.  The  Space  Shuttle 
Program  office  at  Johnson  manages  the  RCC  support  contract. 
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The  launch  of  STS-107  on  January  16,  2003. 


Part  One 


The  Accident 


"Building  rockets  is  hard."  Part  of  the  problem  is  that  space 
travel  is  in  its  infancy.  Although  humans  have  been  launch- 
ing orbital  vehicles  for  almost  50  years  now  -  about  half  the 
amount  of  time  we  have  been  flying  airplanes  -  contrast  the 
numbers.  Since  Sputnik,  humans  have  launched  just  over 
4,500  rockets  towards  orbit  (not  counting  suborbital  flights 
and  small  sounding  rockets).  During  the  first  50  years  of 
aviation,  there  were  over  one  million  aircraft  built.  Almost 
all  of  the  rockets  were  used  only  once;  most  of  the  airplanes 
were  used  more  often. 

There  is  also  the  issue  of  performance.  Airplanes  slowly 
built  their  performance  from  the  tens  of  miles  per  hour  the 
Wright  Brothers  initially  managed  to  the  4.520  mph  that  Ma- 
jor William  J.  Knight  flew  in  the  X-15A-2  research  airplane 
during  1967.  Aircraft  designers  and  pilots  would  slightly 
push  the  envelope,  slop  and  get  comfortable  with  where  they 
were,  then  push  on.  Orbital  rockets,  by  contrast,  must  have 
ail  of  their  performance  on  the  first  (and  often,  only)  flight. 
Physics  dictates  this  -  to  reach  orbit,  without  falling  back  to 
Earth,  you  have  to  exceed  about  17,500  mph.  If  you  cannot 
vary  performance,  then  the  only  thing  left  to  change  is  the 
amount  of  payload  -  the  rocket  designers  began  with  small 
payloads  and  worked  their  way  up. 

Rockets,  by  their  very  nature,  are  complex  and  unforgiving 
vehicles.  They  must  be  as  light  as  possible,  yet  attain  out- 
standing performance  to  get  to  orbit.  Mankind  is,  however, 
getting  better  at  building  them.  In  the  early  days  as  often 
as  not  the  vehicle  exploded  on  or  near  the  launch  pad;  that 
seldom  happens  any  longer.  It  was  not  that  different  from 
early  airplanes,  which  tended  to  crash  about  as  often  as  they 
flew.  Aircraft  seldom  crash  these  days,  but  rockets  still  fail 
between  two-and-five  percent  of  the  time.  This  is  true  of 
just  about  any  launch  vehicle  -Atlas.  Delta,  Soyuz,  Shuttle 
-  regardless  of  what  nation  builds  it  or  what  basic  configura- 
tion is  used;  they  all  fail  about  the  same  amount  of  the  time. 
Building  and  launching  rockets  is  still  a  very  dangerous 
business,  and  will  continue  to  be  so  for  the  foreseeable  fu- 
ture while  we  gain  experience  at  it.  It  is  unlikely  that  launch- 


ing a  space  vehicle  will  ever  be  as  routine  an  undertaking  as 
commercial  air  travel  -  certainly  not  in  the  lifetime  of  any- 
body who  reads  this.  The  scientists  and  engineers  continu- 
ally work  on  better  ways,  but  if  we  want  to  continue  going 
into  outer  space,  we  must  continue  to  accept  the  risks. 

Pail  One  of  the  report  of  the  Columbia  Accident  Investiga- 
tion Board  is  organized  into  four  chapters.  In  order  to  set 
the  background  for  further  discussion.  Chapter  I  relates  the 
history  of  the  Space  Shuttle  Program  before  the  Challenger 
accident.  The  events  leading  to  the  original  approval  of  the 
Space  Shuttle  Program  are  recounted,  as  well  as  an  exami- 
nation of  some  of  the  promises  made  in  order  to  gain  that 
approval.  In  retrospect,  many  of  these  promises  could  never 
have  been  achieved.  Chapter  2  documents  the  final  flight  of 
Colmnbki.  As  a  straightforward  record  of  the  event,  it  con- 
tains no  findings  or  recommendations.  Chapter  3  reviews 
five  analytical  paths  -  aerodynamic,  thermodynamic,  sensor 
data  timeline,  debris  reconstruction,  and  imaging  evidence 
-  to  show  that  all  five  independently  arrive  at  the  same  con- 
clusion. Chapter  4  describes  the  investigation  into  other  pos- 
sible physical  factors  that  might  have  contributed  to  the  ac- 
cident, but  were  subsequently  dismissed  as  possible  causes. 
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The  launch  of  ST S- 107  on  January  ?6,  2003. 


The  Evolution  of  the 
Space  Shuttle  Program 


More  than  two  decades  after  its  first  flight,  the  Space  Shuttle 
remains  the  only  reusable  spacecraft  in  the  world  capable 
of  simultaneously  putting  multiple-person  crews  and  heavy 
cargo  into  orbit,  of  deploying,  servicing,  and  retrieving 
satellites,  and  of  returning  the  products  of  on-orbit  research 
to  Earth.  These  capabilities  are  an  important  asset  for  the 
United  States  and  its  international  partners  in  space.  Current 
plans  call  for  the  Space  Shuttle  to  play  a  central  role  in  the 
U.S.  human  space  flight  program  for  years  to  come. 

The  Space  Shuttle  Program's  remarkable  successes,  how- 
ever, come  with  high  costs  and  tremendous  risks.  The  Feb- 
ruary I  disintegration  of  Columbia  during  re-entry.  17  years 
after  Chulleniicr  was  destroyed  on  ascent,  is  the  most  recent 
reminder  that  sending  people  into  orbit  and  returning  them 
safely  to  Earth  remains  a  difficult  and  perilous  endeavor. 

It  is  the  view  of  the  Columbia  Accident  Investigation  Board 
that  the  Columbia  accident  is  not  a  random  event,  but  rather 
a  product  of  the  Space  Shuttle  Program's  history  and  current 
management  processes.  Fully  understanding  how  it  hap- 
pened requires  an  exploration  of  that  history  and  manage- 
ment. This  chapter  charts  how  the  Shuttle  emerged  from  a 
series  of  political  compromises  that  produced  unreasonable 
expectations  -  even  myths  -  about  its  performance,  how  the 
Challenf>er  accident  shattered  those  myths  several  years  af- 
ter NASA  began  acting  upon  them  as  fact,  and  how,  in  retro- 
spect, the  Shuttle's  technically  ambitious  design  resulted  in 
an  inherently  vulnerable  vehicle,  the  safe  operation  of  which 
exceeded  NASA's  organizational  capabilities  as  they  existed 
at  the  time  of  the  Columbia  accident.  The  Board's  investiga- 
tion of  what  caused  the  Columbia  accident  thus  begins  in  the 
fields  of  East  Texas  but  reaches  more  than  30  years  into  the 
past,  to  a  series  of  economically  and  politically  driven  deci- 
sions that  cast  the  Shuttle  program  in  a  role  that  its  nascent 
technology  could  not  support.  To  understand  the  cause  of  the 
Columbia  accident  is  to  understand  how  a  program  promis- 
ing reliability  and  cost  efficiency  resulted  instead  in  a  devel- 
opmental vehicle  that  never  achieved  the  fully  operational 
status  NASA  and  the  nation  accorded  it. 


1.1     Genesis  OF  THE 

Space  Transportation  System 

The  origins  of  the  Space  Shuttle  Program  date  to  discussions 
on  what  should  follow  Project  Apollo,  the  dramatic  U.S. 
missions  to  the  moon.'  NASA  centered  its  post-Apollo  plans 
on  developing  nicrcasingly  larger  outposts  in  Earth  orbit  that 
would  be  launched  atop  Apollo's  immense  Saturn  V  booster. 
The  space  agency  hoped  to  construct  a  12-person  space  sta- 
tion by  1975;  subsequent  stations  would  support  50.  then 
100  people.  Other  stations  would  be  placed  in  orbit  around 
the  moon  and  then  be  constructed  on  the  lunar  surface.  In 
parallel.  NASA  would  develop  the  capability  for  the  manned 
exploration  of  Mars.  The  concept  of  a  vehicle  -  or  Space 
Shuttle  -  to  take  crews  and  supplies  to  and  from  low-Earth 
orbit  arose  as  part  of  this  grand  vision  ( see  Figure  1 . 1  - 1 ).  To 
keep  the  costs  of  these  trips  to  a  minimum,  NASA  intended 
to  develop  a  fully  reusable  vehicle. - 


Figure  1.1-1.  Early  concepfs  for  the  Space  Shuttle  envisioned  a 
reusable  two-stage  vehicle  with  the  reliability  and  versatility  of  o 
commercial  airliner. 
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NASA's  vision  of  a  constellation  of  space  stations  and  jour- 
neying to  Mars  had  little  connection  with  political  realities 
of  the  time.  In  his  final  year  in  office.  President  Lyndon 
Johnson  gave  highest  priority  to  his  Great  Society  programs 
and  to  dealing  with  the  costs  and  domestic  turmoil  associated 
with  the  Vietnam  war.  Johnson's  successor.  President  Rich- 
ard Nixon,  also  had  no  appetite  for  another  large,  expensive, 
Apollo-like  space  commitment.  Nixon  rejected  NASA's  am- 
bitions with  little  hesitation  and  directed  that  the  agency 's  bud- 
get be  cut  as  much  as  was  politically  feasible.  With  NASA's 
space  station  plans  deferred  and  further  production  of  the 
Saturn  V  launch  vehicle  cancelled,  the  Space  Shuttle  was 
the  only  manned  space  llight  program  that  the  space  agency 
could  hope  to  undertake.  But  without  space  stations  to  ser- 
vice, NASA  needed  a  new  rationale  for  the  Shuttle.  That  ra- 
tionale emerged  from  an  intense  three-year  process  of  tech- 
nical studies  and  political  and  budgetary  negotiations  that 
attempted  to  reconcile  the  conflicting  interests  of  NASA,  the 
Department  of  Defense,  and  the  White  House.' 

1.2    Merging  Conflicting  Interests 

During  1970,  NASA's  leaders  hoped  to  secure  White  House 
approval  for' developing  a  fully  reusable  vehicle  to  provide 
routine  and  low  cost  manned  access  to  space.  However,  the 
staff  of  the  White  House  Office  of  Management  and  Budget, 
charged  by  Nixon  with  reducing  NASA's  budget,  was  skep- 
tical of  the  value  of  manned  space  flight,  especially  given 
its  high  costs.  To  overcome  these  objections,  NASA  turned 
to  justifying  the  Space  Shuttle  on  economic  grounds.  If  the 
same  vehicle,  NASA  argued,  launched  all  government  and 
private  sector  payloads  and  if  that  vehicle  were  reusable, 
then  the  total  costs  of  launching  and  maintaining  satellites 
could  be  dramatically  reduced.  Such  an  economic  argument, 
however,  hinged  on  the  willingness  of  the  Department  of 
Defense  to  use  the  Shuttle  to  place  national  security  pay- 
loads  in  orbit.  When  combined,  commercial,  scientific,  and 
national  security  payloads  would  require  50  Space  Shuttle 
missions  per  year.  This  was  enough  to  justify  -  at  least  on 
paper  -  investing  in  the  Shuttle. 

Meeting  the  military's  perceived  needs  while  also  keeping 
the  cost  of  missions  low  posed  tremendous  technological 
hurdles.  The  Department  of  Defense  wanted  the  Shuttle  to 
carry  a  40,000-pound  payload  in  a  60-foot-long  payload 
bay  and,  on  some  missions,  launch  and  return  to  a  West 
Coast  launch  site  after  a  single  polar  orbit.  Since  the  Earth's 
surface  -  including  the  runway  on  which  the  Shuttle  was  to 
land  -  would  rotate  during  that  orbit,  the  Shuttle  would  need 
to  maneuver  1. 100  miles  to  the  east  during  re-entry.  This 
"cross-range"  requirement  meant  the  Orbiter  required  large 
delta-shaped  wings  and  a  more  robust  thermal  protection 
system  to  shield  it  from  the  heat  of  re-entry. 

Developing  a  vehicle  that  could  conduct  a  wide  variety  of 
missions,  and  do  .so  cost-effectively,  demanded  a  revolution  in 
space  technology.  The  Space  Shuttle  would  be  the  first  reus- 
able spacecraft,  the  first  to  have  wings,  and  the  first  with  a  reus- 
able thermal  pri)tection  system.  Further,  the  Shuttle  would  be 
the  first  to  fly  with  reusable,  high-pressure  hydrogen/oxygen 
engines,  and  the  first  winged  vehicle  to  transition  from  orbital 
speed  to  a  hypersonic  glide  during  re-entry. 


Even  as  the  design  grew  in  technical  complexity,  the  Office  of 
Management  and  Budget  forced  NASA  to  keep  -  or  at  least 
promise  to  keep  -  the  Shuttle's  development  and  operating 
costs  low.  In  May  1 97 1 ,  NASA  was  told  that  it  could  count  on 
a  maximum  of  $3  billion  spread  over  five  years  for  any  new 
development  program.  This  budget  ceiling  forced  NASA  to 
give  up  its  hope  of  building  a  fully  reusable  two-stage  vehicle 
and  kicked  off  an  intense  six-month  search  for  an  alternate 
design,  in  the  course  of  selling  the  Space  Shuttle  Program 
within  these  budget  limitations,  and  therefore  guaranteeing 
itself  a  viable  post-Apollo  future,  NASA  made  bold  claims 
about  the  expected  savings  to  be  derived  from  revolutionary 
technologies  not  yet  developed.  At  the  start  of  1972,  NASA 
leaders  told  the  White  House  that  for  $5. 1 5  billion  they  could 
develop  a  Space  Shuttle  that  would  meet  all  performance 
requirements,  have  a  lifetime  of  100  missions  per  vehicle, 
and  cost  $7.7  million  per  flight.^  All  the  while,  many  people, 
particularly  those  at  the  White  House  Office  of  Management 
and  Budget,  knew  NASA's  in-house  and  external  economic 
studies  were  overly  optimistic.^ 

Those  in  favor  of  the  Shuttle  program  eventually  won  the 
day.  On  January  5,  1972,  President  Nixon  announced  that 
the  Shuttle  would  be  "designed  to  help  transform  the  space 
frontier  of  the  1970s  into  familiar  territory,  easily  accessible 
for  human  endeavor  in  the  1980s  and  90s.  This  system  will 
center  on  a  space  vehicle  that  can  shuttle  repeatedly  from 
Earth  to  orbit  and  back.  It  will  revdhttioiiize  transpurtation 
into  near  space,  hy  roiitiniziiii;  it.  (emphasis  added)"''  Some- 
what ironically,  the  President  based  his  decision  on  grounds 
very  different  from  those  vigorously  debated  by  NASA  and 
the  White  House  budget  and  science  offices.  Rather  than 
focusing  on  the  intricacies  of  cost/benefit  projections,  Nixon 
was  swayed  by  the  political  benefits  of  increasing  employ- 
ment in  key  states  by  initiating  a  major  new  aerospace  pro- 
gram in  the  1972  election  year,  and  by  a  geopolitical  calcula- 
tion articulated  most  clearly  by  NASA  Administrator  James 
Fletcher.  One  month  before  the  decision,  Fletcher  wrote  a 
memo  to  the  White  House  stating,  "For  the  U.S.  not  to  be 
in  space,  while  others  do  have  men  in  space,  is  unthinkable, 
and  a  position  which  America  cannot  accept."^ 

The  cost  projections  Nixon  had  ignored  were  not  forgotten 
by  his  budget  aides,  or  by  Congress.  A  $5.5  billion  ceiling 
imposed  by  the  Office  of  Management  and  Budget  led  NASA 
to  make  a  number  of  tradeoffs  that  achieved  savings  in  the 
short  term  but  produced  a  vehicle  that  had  higher  operational 
costs  and  greater  risks  than  promised.  One  example  was  the 
question  of  whether  the  "strap-on"  boosters  would  use  liquid 
or  solid  propellants.  Even  though  they  had  higher  projected 
operational  costs,  solid-rocket  boosters  were  chosen  largely 
because  they  were  less  expensive  to  develop,  making  the 
Shuttle  the  first  piloted  spacecraft  to  use  solid  boosters.  And 
since  NASA  believed  that  the  Space  Shuttle  would  be  far 
safer  than  any  other  spacecraft,  the  agency  accepted  a  design 
with  no  crew  escape  system  {see  Chapter  10.) 

The  commitments  NASA  made  during  the  policy  process 
drove  a  design  aimed  at  satisfying  conflicting  requirements: 
large  payloads  and  cross-range  capability,  but  also  low 
development  costs  and  the  even  lower  operating  costs  of  a 
"routine"  .system.  Over  the  past  22  years,  the  resulting  ve- 
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hide  has  proved  difficult  and  costly  to  operate,  riskier  than 
expected,  and,  on  two  occasions,  deadly. 

It  is  the  Board's  view  that,  in  retrospect,  the  increased  com- 
plexity of  a  Shuttle  designed  to  be  all  things  to  all  people 
created  inherently  greater  risks  than  if  more  realistic  tech- 
nical goals  had  been  set  at  the  start.  Designing  a  reusable 
spacecraft  that  is  also  cost-effective  is  a  daunting  engineer- 
ing challenge;  doing  so  on  a  tightly  constrained  budget  is 
even  more  difficult.  Nevertheless,  the  remarkable  system 
we  have  today  is  a  reflection  of  the  tremendous  engineering 
expertise  and  dedication  of  the  workforce  that  designed  and 
built  the  Space  Shuttle  w  ithin  the  constraints  it  was  given. 

In  the  end,  the  greatest  compromise  NASA  made  was  not  so 
much  with  any  particular  element  of  the  technical  design, 
but  rather  with  the  premise  of  the  vehicle  itself.  NASA 
promised  it  could  develop  a  Shuttle  that  would  be  launched 
almost  on  demand  and  would  fly  many  missions  each  year. 
Throughout  the  history  of  the  program,  a  gap  has  persisted 
between  the  rhetoric  NASA  has  used  to  market  the  Space 
Shuttle  and  operational  reality,  leading  to  an  enduring  image 
of  the  Shuttle  as  capable  of  safely  and  routinely  carrying  out 
missions  with  little  risk. 

1 .3    Shuhle  Development,  Testing, 
AND  Qualification 

The  Space  Shuttle  was  subjected  to  a  variety  of  tests  before 
its  first  flight.  However,  NASA  conducted  these  tests  some- 
what differently  than  it  had  for  previous  spacecraft."  The 
Space  Shuttle  Program  philosophy  was  to  ground-test  key 
hardware  elements  such  as  the  main  engines.  Solid  Rocket 
Boosters.  External  Tank,  and  Orbiter  separately  and  to  use 
analytical  models,  not  flight  testing,  to  certify  the  integrated 
Space  Shuttle  system.  During  the  Approach  and  Landing 
Tests  (see  Figure  1 .3- 1 ).  crews  verified  that  the  Orbiter  could 
successfully  fly  at  low  speeds  and  land  safely;  however,  the 
Space  Shuttle  was  not  flown  on  an  unmanned  orbital  test 
flight  prior  to  its  first  mission  -  a  significant  change  in  phi- 
losophy compared  to  that  of  earlier  American  spacecraft 


Figure  ).3-J.  The  firsf  Orbiter  was  Enterprise,  shown  here  being 
released  from  >he  Boeing  747  ShuHle  Carrier  Aircraft  during  the 
Approach  and  landing  Tests  at  Edwards  Air  Force  Base. 


The  significant  advances  in  technology  that  the  Shuttle's 
design  depended  on  led  its  development  to  run  behind 
schedule.  The  dale  for  the  first  Space  Shuttle  launch  slipped 
from  March  1978  to  1979,  then  to  1980.  and  finally  to  the 
spring  of  198 1 .  One  historian  has  attributed  one  year  of  this 
delay  "to  budget  cuts,  a  second  year  to  problems  with  the 
main  engines,  and  a  third  year  to  problems  with  the  thermal 
protection  tiles.""  Because  of  these  difficulties,  in  1979  the 
program  underwent  an  exhaustive  White  House  review.  The 
program  was  thought  to  be  a  billion  dollars  over  budget, 
and  President  Jimmy  Carter  wanted  to  make  sure  that  it  was 
worth  continuing.  A  key  factor  in  the  White  House's  final 
assessment  was  that  the  Shuttle  was  needed  to  launch  the 
intelligence  satellites  required  for  verification  of  the  SALT 
II  arms  control  treaty,  a  top  Carter  Administration  priority. 
The  review  reaffirmed  the  need  for  the  Space  Shuttle,  and 
with  continued  White  House  and  Congressional  support,  the 
path  was  clear  for  its  transition  from  development  to  flight. 
NASA  ultimately  completed  Shuttle  development  for  only 
15  percent  more  than  its  projected  cost,  a  comparatively 
small  cost  oveirun  for  so  complex  a  program.'" 

The  Orbiter  that  was  destined  to  be  the  first  to  fly  into  space 
was  Coliinihia.  In  early  1979,  NASA  was  beginning  to  feel 
the  pressure  of  being  behind  schedule.  Despite  the  fact  that 
only  24,000  of  the  30,000  Thermal  Protection  System  tiles 
had  been  installed,  NASA  decided  to  fly  Coliinihia  from  the 
manufacturing  plant  in  Palmdale,  California,  to  the  Kennedy 
Space  Center  in  March  1979.  The  rest  of  the  tiles  would  be 
installed  in  Florida,  thus  allowing  NASA  to  maintain  the 
appearance  of  Coliiiuhia'a  scheduled  launch  date.  Problems 
with  the  main  engines  and  the  tiles  were  to  leave  Coliinihia 
grounded  for  two  more  years. 

1.4    The  SHunLE  Becomes  "Operational" 

On  the  first  Space  Shuttle  mission,  STS-I,"  Coliinihia  car- 
ried John  W.  Young  and  Robert  L.  Crippen  to  orbit  on  April 
12,  1981,  and  returned  them  safely  two  days  later  to  Ed- 
wards Air  Force  Base  in  California  (see  Figure  1 .4-1 ).  After 
three  years  of  policy  debate  and  nine  years  of  development, 
the  Shuttle  returned  U.S.  astronauts  to  space  for  the  first  time 
since  the  Apollo-Soyuz  Test  Project  flew  in  July  1975.  Post- 
flight  inspection  showed  that  Coliinihia  suffered  slight  dam- 
age from  excess  Solid  Rocket  Booster  ignition  pressure  and 
lost  16  tiles,  with  148  others  sustaining  some  damage.  Over 
the  following  15  months,  Columbia  was  launched  three 
more  times.  At  the  end  of  its  fourth  mission,  on  July  4.  1982, 
Coliinihia  landed  at  Edwards  where  President  Ronald  Rea- 
gan declared  to  a  nation  celebrating  Independence  Day  that 
"beginning  with  the  next  flight,  the  Coliinihia  and  her  sister 
ships  will  he  fully  operatitnuil.  ready  to  provide  economi- 
cal and  miiiine  access  to  space  for  scientific  exploration, 
commercial  ventures,  and  for  tasks  related  to  the  national 
security"  [emphasis  added |.'- 

There  were  two  reasons  for  declaring  the  Space  Shuttle  "op- 
erational" so  early  in  its  flight  program.  One  was  NASA's 
hope  for  quick  Presidential  approval  of  its  next  manned 
space  flight  program,  a  space  station,  which  would  not 
move  forward  while  the  Shuttle  was  still  considered  devel- 
opmental. The  second  reason  was  that  the  nation  was  sud- 
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Figure  1.4-1.  The  April  12,  1981,  launch  of  STS-1,  just  seconds  posf 
7  a.m.,  carried  osfronoufs  John  Young  and  Roberf  Crippen  info  on 
Earth  orbital  mission  that  lasted  54  hours. 


denly  facing  a  foreign  challenger  in  launching  commercial 
satellites.  The  European  Space  Agency  decided  in  1973  to 
develop  Ariane,  an  expendable  launch  vehicle.  Ariane  first 
flew  in  December  1979  and  by  1982  was  actively  competing 
with  the  Space  Shuttle  for  commercial  launch  contracts.  At 
this  point,  NASA  still  hoped  that  revenue  from  commercial 
launches  would  offset  some  or  all  of  the  Shuttle's  operating 
costs.  In  an  effort  to  attract  commercial  launch  contracts, 
NASA  heavily  subsidized  commercial  launches  by  offering 
services  for  $42  million  per  launch,  when  actual  costs  were 
more  than  triple  that  figure."  A  1983  NASA  brochure  titled 
We  Deliver  touted  the  Shuttle  as  "the  most  reliable,  flexible, 
and  cost-effective  launch  system  in  the  world. "'^ 


Figure  1.4-2.  The  crew  of  STS-5  successfully  deployed  two 
commercial  communications  satellites  during  the  first  "operational" 
mission  of  the  Space  Shuttle. 


Between  1982  and  early  1986,  the  Shuttle  demonstrated  its 
capabilities  for  space  operations,  retrieving  two  commu- 
nications satellites  that  had  suffered  upper-stage  misfires 
after  launch,  repairing  another  communications  satellite 
on-orbit,  and  flying  science  missions  with  the  pressur- 
ized European-built  Spacelab  module  in  its  payload  bay. 
The  Shuttle  took  into  space  not  only  U.S.  astronauts,  but 
also  citizens  of  Germany,  Mexico,  Canada,  Saudi  Arabia, 
France,  the  Netherlands,  two  payload  specialists  from 
commercial  enterprises,  and  two  U.S.  legislators.  Senator 
Jake  Garn  and  Representative  Bill  Nelson.  In  1985,  when 
four  Orbiters  were  in  operation,  the  vehicles  flew  nine  mis- 
sions, the  most  launched  in  a  single  calendar  year.  By  the 
end  of  1985,  the  Shuttle  had  launched  24  communications 
satellites  (see  Figure  1.4-2)  and  had  a  backlog  of  44  orders 
for  future  commercial  launches. 

On  the  surface,  the  program  seemed  to  be  progressing  well. 
But  those  close  to  it  realized  that  there  were  numerous  prob- 
lems. The  system  was  proving  difficult  to  operate,  with  more 
maintenance  required  between  flights  than  had  been  expect- 
ed. Rather  than  needing  the  10  working  days  projected  in 
1975  to  process  a  returned  Orbiter  for  its  next  flight,  by  the 
end  of  1985  an  average  of  67  days  elapsed  before  the  Shuttle 
was  ready  for  launch.''* 

Though  assigned  an  operational  role  by  NASA,  during  this 
period  the  Shuttle  was  in  reality  .still  in  its  early  flight-test 
stage.  As  with  any  other  first-generation  technology,  opera- 
tors were  learning  more  about  its  strengths  and  weaknesses 
from  each  flight,  and  making  what  changes  they  could,  while 
still  attempting  to  ramp  up  to  the  ambitious  flight  schedule 
NASA  set  forth  years  earlier.  Already,  the  goal  of  launching 
50  flights  a  year  had  given  way  to  a  goal  of  24  flights  per  year 
by  1989.  The  per-mission  cost  was  more  than  $140  million,  a 
figure  that  when  adjusted  for  inflation  was  seven  times  great- 
er than  what  NASA  projected  over  a  decade  earlier."'  More 
troubling,  the  pressure  of  maintaining  the  flight  schedule  cre- 
ated a  management  atmosphere  that  increasingly  accepted 
less-than-specification  performance  of  various  components 
and  systems,  on  the  grounds  that  such  deviations  had  not 
interfered  with  the  success  of  previous  flights.' 

1.5    The  Chauenger  Accident 

The  illusion  that  the  Space  Shuttle  was  an  operational 
system,  safe  enough  to  carry  legislators  and  a  high-school 
teacher  into  orbit,  was  abruptly  and  tragically  shattered  on 
the  morifing  of  January  28,  1986,  when  Challeiii^er  was  de- 
stroyed 73  seconds  after  launch  during  the  25th  mission  (see 
Figure  1 .5- 1 1.  The  seven-member  crew  perished. 

To  investigate.  President  Reagan  appointed  the  13-member 
Presidential  Commission  on  the  Space  Shuttle  Challenger 
Accident,  which  soon  became  known  as  the  Rogers  Com- 
mission, after  its  chairman,  former  Secretary  of  State  Wil- 
liam P.  Rogers."*  Early  in  its  investigation,  the  Commission 
identified  the  mechanical  cause  of  the  accident  to  be  the 
failure  of  the  joint  of  tine  of  the  Solid  Rocket  Boosters.  The 
Commission  foimd  that  the  design  was  not  well  understood 
by  the  engineers  that  operated  it  and  that  it  had  not  been 
adequately  tested. 
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Figure  1.5-1.  the  Space  Shuttle  Challenger  v/os  lost  during  ascent 
on  January  28,  J986,  when  an  O-ring  and  seal  in  the  right  Solid 
Rocket  Booster  failed. 


When  the  Rogers  Commission  discovered  that,  on  the  eve  of 
the  launch,  NASA  and  a  contractor  had  vigorously  debated 
the  wisdom  of  operating  the  Shuttle  in  the  cold  temperatures 
predicted  for  the  next  day,  and  that  more  senior  NASA 
managers  were  unaware  of  this  debate,  the  Commission 
shifted  the  focus  of  its  investigation  to  "NASA  manage- 
ment practices.  Center-Headquarters  relationships,  and  the 
chain  of  command  for  launch  commit  decisions."'''  As  the 
investigation  continued,  it  revealed  a  NASA  culture  that 
had  gradually  begun  to  accept  escalating  risk,  and  a  NASA 
safety  program  that  was  largely  silent  and  ineffective. 

The  Rogers  Commission  report,  issued  on  June  6,  1986, 
recommended  a  redesign  and  recertification  of  the  Solid 
Rocket  Motor  joint  and  seal  and  urged  that  an  indepen- 
dent body  oversee  its  qualification  and  testing.  The  report 
concluded  that  the  drive  to  declare  the  Shuttle  operational 
had  put  enormous  pressures  on  the  system  and  stretched  its 
resources  to  the  limit.  Faulting  NASA  safety  practices,  the 
Commission  also  called  for  the  creation  of  an  independent 
NASA  Office  of  Safety,  Reliability,  and  Quality  Assurance, 
reporting  directly  to  the  NASA  Administrator,  as  well  as 
structural  changes  in  program  management.-"  (The  Rogers 
Commission  findings  and  recommendations  are  discussed  in 
more  detail  in  Chapter  5.)  It  would  take  NASA  32  months 
before  the  next  Space  Shuttle  mission  was  launched.  Dur- 
ing this  time,  NASA  initiated  a  series  of  longer-term  vehicle 
upgrades,  began  the  construction  of  the  Orbiter  Endeavour 
to  replace  Cliallenf^er,  made  significant  organizational 
changes,  and  revised  the  Shuttle  manifest  to  reflect  a  more 
realistic  flight  rate. 

The  Challcnfier  accident  also  prompted  policy  changes.  On 
August  15,  1986,  President  Reagan  announced  that  the  Shut- 
tle would  no  longer  launch  commercial  satellites.  As  a  result 
of  the  accident,  the  Department  of  Defense  made  a  decision 
to  launch  all  future  military  payloads  on  expendable  launch 
vehicles,  except  the  few  remaining  satellites  that  required 
the  Shuttle's  unique  capabilities. 


In  the  seventeen  years  between  the  Challenfjer  and  Co- 
lumbia accidents,  the  Space  Shuttle  Program  achieved 
significant  successes  and  also  underwent  organizational  and 
managerial  changes.  The  program  had  successfully  launched 
several  important  research  satellites  and  was  providing  most 
of  the  "heavy  lifting"  of  components  necessary  to  build  the 
International  Space  Station  (see  Figure  1.5-2).  But  as  the 
Board  subsequently  learned,  things  were  not  necessarily  as 
they  appeared.  (The  posl-Challenger  history  of  the  Space 
Shuttle  Program  is  the  topic  of  Chapter  5.) 


Figure    1.5-2.    The  International  Space  Station  as  seen  from  an 
approaching  Space  Shuttle. 


1.6    Concluding  Thoughts 

The  Orbiter  that  carried  the  STS-107  crew  to  orbit  22  years 
after  its  first  flight  reflects  the  histoid  of  the  Space  Shuttle 
Program.  When  Cohiinhia  lifted  off  from  Launch  Complex 
39-A  at  Kennedy  Space  Center  on  January  16,  2003,  it  su- 
perficially resembled  the  Orbiter  that  had  first  flown  in  1981. 
and  indeed  many  eleinents  of  its  airframe  dated  back  to  its 
first  flight.  More  than  44  percent  of  its  tiles,  and  41  of  the 
44  wing  leading  edge  Reinforced  Carbon-Carbon  (RCC) 
panels  were  original  equipment.  But  there  were  also  many 
new  systems  in  Columbia,  from  a  modern  "glass"  cockpit  to 
second-generation  main  engines. 

Although  an  engineering  marvel  that  enables  a  wide-variety 
of  on-orbit  operations,  including  the  assembly  of  the  Inter- 
national Space  Station,  the  Shuttle  has  few  of  the  mission 
capabilities  that  NASA  originally  promised.  It  cannot  be 
launched  on  demand,  does  not  recoup  its  costs,  no  longer 
carries  national  security  payloads,  and  is  not  cost-effective 
enough,  nor  allowed  by  law,  to  carry  commercial  satellites. 
Despite  efforts  to  improve  its  safety,  the  Shuttle  remains  a 
complex  and  risky  system  that  remains  central  to  U.S.  ambi- 
tions in  space.  Columbia's  failure  to  return  home  is  a  harsh 
reminder  that  the  Space  Shuttle  is  a  developmental  vehicle 
that  operates  not  in  routine  flight  but  in  the  realm  of  danger- 
ous exploration. 
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Space  Shuttle  missions  are  not  necessarily  launched  in  the 
same  order  they  are  planned  (or  "manifested."  as  NASA 
calls  the  process).  A  variety  of  scheduling,  funding,  tech- 
nical, and  -  occasionally  -  political  reasons  can  cause  the 
shuffling  of  missions  over  the  course  of  the  two  to  three 
years  it  takes  to  plan  and  launch  a  flight.  This  explains  why 
the  1 13th  mission  of  the  Space  Shuttle  Program  was  called 
STS-107.  It  would  be  the  28th  flight  ofColiinihici. 

While  the  STS-107  mission  will  likely  be  remembered  most 
for  the  way  it  ended,  there  was  a  great  deal  more  to  the 
dedicated  science  mission  than  its  tragic  conclusion.  The 
planned  microgravity  research  spanned  life  sciences,  physi- 
cal sciences,  space  and  earth  sciences,  and  education.  More 
than  70  scientists  were  involved  in  the  research  that  was 
conducted  by  Coliiiiihia's  seven-member  crew  over  1 6  days. 
This  chapter  outlines  the  history  of  STS-107  from  its  mis- 
sion objectives  and  their  rationale  through  the  accident  and 
its  initial  aftermath.  The  analysis  of  the  accident's  causes 
follows  in  Chapter  3  and  subsequent  chapters. 

2.1     Mission  Objectives  and  Their  Rationales 

Throughout  the  1990s.  NASA  flew  a  number  of  dedicated 
science  missions,  usually  aboard  Coliimhia  because  it  was 
equipped  for  extended-duration  missions  and  was  not  being 
used  for  Shuttle-Mir  docking  missions  or  the  assembly  of 
the  International  Space  Station.  On  many  of  these  missions, 
Columbia  carried  pressurized  Spacelab  or  SPACEHAB 
modules  that  extended  the  habitable  experiment  space  avail- 
able and  were  intended  as  facilities  for  life  sciences  and 
microgravity  research. 

In  June  1997,  the  Flight  Assignment  Working  Group  at  John- 
son Space  Center  in  Houston  designated  STS- 1 07,  tentatively 
scheduled  for  launch  in  the  third  quarter  of  Fiscal  Year  2000,  a 
"research  module"  flight.  In  July  1997,  several  committees  of 
the  National  Academy  of  Science's  Space  Studies  Board  sent 
a  letter  to  NASA  Administrator  Daniel  Goldin  recommend- 
ing that  NASA  dedicate  several  future  Shuttle  missions  to 
microgravity  and  life  sciences.  The  purpose  would  be  to  train 
scientists  to  take  full  advantage  of  the  International  Space 
Station's  research  capabilities  once  it  became  operational, 
and  to  reduce  the  gap  between  the  last  planned  Shuttle  science 


mission  and  the  start  of  science  research  aboard  the  Space 
Station.'  In  March  1998.  Goldin  announced  that  STS-107. 
tentatively  scheduled  for  launch  in  May  2000.  would  be  a 
multi-disciplinary  science  mission  modeled  after  STS-90.  the 
Neurolab  mi.ssion  scheduled  later  in  1998.^  In  October  1998. 
the  Veterans  Affairs  and  Housing  and  Urban  Development 
and  Independent  Agencies  Appropriations  Conference  Re- 
port expressed  Congress'  concern  about  the  lack  of  Shuttle- 
based  science  missions  in  Fiscal  Year  1999,  and  added  $\5 
million  to  NASA's  budget  for  STS-107.  The  following  year 
the  Conference  Report  reserved  $40  million  for  a  second  sci- 
ence mission.  N.-XS A  cancelled  the  second  science  mission  in 
October  2002  and  used  the  money  for  STS-107. 

In  addition  to  a  variety  of  U.S.  experiments  assigned  to 
STS-107.  a  joint  U.S. /Israeli  space  experiment  -  the  Medi- 
terranean-Israeli Dust  Experiment,  or  MEIDEX  -  was  added 
to  STS-107  to  be  accompanied  by  an  Israeli  astronaut  as 
part  of  an  international  cooperative  effort  aboard  the  Shuttle 
similar  to  those  NASA  had  begun  in  the  early  1980s.  Triaiui, 
a  deployable  Earth-observing  satellite,  was  also  added  to  the 
mission  to  save  NASA  from  having  to  buy  a  commercial 
launch  to  place  the  satellite  in  orbit.  Political  disagreements 
between  Congress  and  the  White  House  delayed  Triana,  and 
the  satellite  was  replaced  by  the  Fast  Reaction  Experiments 
Enabling  Science,  Technology,  Applications,  and  Research 
(FREESTAR)  payload.  which  was  mounted  behind  the 
SPACEHAB  Research  Double  Module.' 


Figure  2.1-1 .  Columbia,  at  the  launch  pad  on  January  15,  2003. 
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Schedule  Slippage 

STS-107  was  finally  scheduled  for  launch  on  January  II, 
2001.  After  13  delays  over  two  years,  due  mainly  to  other 
missions  taking  priority,  Colnmhia  was  launched  on  January 
16,  2003  (see  Figure  2. 1-1 ).  Delays  may  take  several  fomis. 
When  any  delay  is  mentioned,  most  people  think  of  a  Space 
Shuttle  sitting  on  the  launch  pad  waiting  for  launch.  But  mo.st 
delays  actually  occur  long  before  the  Shuttle  is  configured  for 
a  mission.  This  was  the  case  for  STS-107  -  of  the  1 3  delays, 
only  a  few  occurred  after  the  Orbiter  was  configured  for 
flight;  most  happened  earlier  in  the  planning  process.  Three 
specific  events  caused  delays  for  STS-107: 

•  Removal  of  Trhiiur.  This  Earth-observing  satellite  was 
replaced  with  the  FREESTAR  payload. 

•  Orbiter  Maintenance  Down  Period:  Columhici's  depot- 
level  maintenance  took  six  months  longer  than  original- 
ly planned,  primarily  to  correct  problems  encountered 
with  Kapton  wiring  (see  Chapter  4).  This  resulted  in  the 
STS-109  Hubble  Space  Telescope  service  mission  be- 
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Coliimhki  was  named  after  a  Boston-based  sloop  com- 
manded by  Captain  Robert  Gray,  who  noted  while  sailing  to 
the  Pacific  Northwest  a  flow  of  muddy  water  fanning  from 
the  shore,  and  decided  to  explore  what  he  deemed  the  "Great 
River  of  the  West."  On  May  11,  1792.  Gray  and  his  crew 
maneuvered  the  Colnmhia  past  the  treacherous  sand  bar  and 
named  the  river  after  his  ship.  After  a  week  or  so  of  trading 
with  the  local  tribes.  Gray  left  without  investigating  where 
the  river  led.  Instead,  Gray  led  the  Colnmhia  and  its  crew  on 
the  first  U.S.  circumnavigation  of  the  globe,  carrying  otter 
skins  to  Canton,  China,  before  returning  to  Boston  in  1793. 

In  addition  to  Colnmhia  (0V-I()2),  which  first  flew  in  1981, 
Challenger  (OV-099)  first  flew  in  1 983.  Discovery  (OV- 1 03 ) 
in  1 984,  and  Atlantis  (OV- 1 04)  in  1 985.  Endeavonr(0\- 1 05), 
which  replaced  Challenf^er.  first  flew  in  1992.  At  the  time 
of  the  launch  of  ST.S-107.  Colnmhia  was  unique  since  it 
was  the  last  remaining  Orbiter  to  have  an  internal  airlock 
on  the  mid-deck.  (All  the  Orbiters  originally  had  internal 
aidocks.  but  all  excepting  Colnmhia  were  modified  to  pro- 
vide an  external  docking  mechanism  for  flights  to  Mir  and 
the  International  Space  Station.)  Because  the  airlock  was 
not  located  in  the  payload  bay,  Colnmhia  could  carry  longer 
payloads  such  as  the  Chandra  space  telescope,  which  used 
the  full  length  of  the  payload  bay.  The  internal  airlock  made 
the  mid-deck  more  cramped  than  those  of  other  Orbiters,  but 
this  was  less  of  a  problem  when  one  of  the  laboratory  mod- 
ules was  installed  in  the  payload  bay  to  provide  additional 
habitable  volume. 

Colnmhia  had  been  manufactured  to  an  early  structtiral 
standard  that  resulted  in  the  airframe  being  heavier  than  the 
later  Orbiters.  Coupled  with  a  more-forward  center  of  grav- 
ity because  of  the  internal  aidock,  Colnmhia  could  not  carry 
as  much  payload  weight  into  orbit  as  the  other  Orbiters.  This 
made  Colnmhia  less  desirable  for  missions  to  the  Interna- 
tional Space  Station,  although  planning  was  nevertheless 
underway  to  modify  Colnmhia  for  an  International  Space 
Station  flight  sometime  after  STS-107. 


ing  launched  before  STS-107  because  it  was  considered 
more  urgent. 

•  Flowliner  cracks:  About  one  month  before  the  planned 
July  19,  2002  launch  date  for  STS-107,  concerns  about 
cracks  in  the  Space  Shuttle  Main  Engine  propellant 
system  flowliners  caused  a  four-month  grounding  of 
the  Orbiter  fleet.  (The  flowliner,  which  is  in  the  inain 
propellant  feed  lines,  mitigates  turbulence  across  the 
flexible  bellows  to  smooth  the  flow  of  propellant  into 
the  main  engine  low-pressure  turbopump.  It  also  pro- 
tects the  bellows  from  flow-induced  vibration.)  First 
discovered  on  Atlantis,  the  cracks  were  eventually 
discovered  on  each  Orbiter;  they  were  fixed  by  weld- 
ing and  polishing.  The  grounding  delayed  the  e.xchange 
of  the  Expedition  5  International  Space  Station  crew 
with  the  Expedition  6  crew,  which  was  scheduled  for 
STS-113.  To  maintain  the  International  Space  Sta- 
tion assembly  sequence  while  minimizing  the  delay 
in  returning  the  Expedition  5  crew,  both  STS-112  and 
STS-1 13  were  launched  before  STS-107. 

The  Crew 

The  STS-107  crew  selection  process  followed  standard  pro- 
cedures. The  Space  Shuttle  Program  provided  the  Astronaut 
Office  with  mission  requirements  calling  for  a  crew  of  seven. 
There  were  no  special  requirements  for  a  rendezvous,  extra- 
vehicular activity  (spacewalking),  or  use  of  the  remote  ma- 
nipulator arm.  The  Chief  of  the  Astronaut  Office  announced 
the  crew  in  July  2000.  To  maximize  the  amount  of  science  re- 
search that  could  be  performed,  the  crew  formed  two  teams, 
Red  and  Blue,  to  support  around-the-clock  operations. 

Crew  Training 

The  Columbia  Accident  Investigation  Board  thoroughly  re- 
viewed all  pre-mission  training  (see  Figure  2.1-2)  for  the 
STS-107  crew,  Houston  Mission  Controllers,  and  the  Ken- 


Figure  2.) -2.  tian  Ramon  (left),  Laurel  Clark,  and  Michael  Ander- 
son during  a  training  exercise  at  the  Johnson  Space  Center. 


Report    Volume    I 


IGUST      Z003 


Left  to  right:  David  Brown,  Rick  Husband,  Laurel  Clark,  Kalpana  Chawla,  Michael  Anderson,  William  McCool,  llan  Ramon. 


Rick  Husband,  Commander.  Husband.  45.  was  a  Colonel  in  the 
U.S.  Air  Force,  a  test  pilot,  and  a  veteran  of  ST.S -96.  He  received  a 
B.S.  in  Mechanical  Engineering  from  Texas  Tech  University  and  a 
M.S.  in  Mechanical  Engineering  from  California  State  University, 
Fresno.  He  was  a  member  of  the  Red  Team,  working  on  experi- 
ments including  the  European  Research  In  Space  and  Terrestrial 
Osteoporosis  and  the  Shuttle  Ozone  Limb  Sounding  Experiment. 

William  C.  McCool,  Pilot.  McCool,  41,  was  a  Commander  in  the 
U.S.  Navy  and  a  test  pilot.  He  received  a  B.S.  in  Applied  Science 
from  the  U.S.  Naval  Academy,  a  M.S.  in  Computer  Science  from 
the  University  of  Maryland,  and  a  M.S.  in  Aeronautical  Engi- 
neering from  the  U.S.  Naval  Postgraduate  School.  A  member  of 
the  Blue  Team,  McCool  worked  on  experiments  including  the 
Advanced  Respirator)-  Monitoring  System,  Biopack,  and  Mediter- 
ranean Israeli  Dust  Experiment. 

Michael  P.  Anderson,  Payload  Commander  and  Mission  Special- 
ist. Anderson,  43,  was  a  Lieutenant  Colonel  in  the  U.S.  Air  Force, 
a  former  instructor  pilot  and  tactical  officer,  and  a  veteran  of 
STS-89.    He    received    a    B.S.    in 

Physics/Astronomy    from    the    Uni-  THE 

versity  of  Washington,  and  a  M.S.  in 
Physics  from  Creighton  University.  A 
member  of  the  Blue  Team,  Anderson 
worked  with  experiments  including 
the  Advanced  Respiratory  Monitor- 
ing System.  Water  Mist  Fire  Suppres- 
sion, and  Structures  of  Flame  Balls  at 
Low  Lewis-number. 

David  M.  Brown,  Mission  Specialist. 
Brown,  46,  was  a  Captain  in  the  U.S. 
Navy,  a  naval  aviator,  and  a  naval 
night  surgeon.  He  received  a  B.S.  in 
Biology  from  the  College  of  William 
and  Mary  and  a  M.D.  from  Eastern 
Virginia  Medical  School.  A  member 


of  the  Blue  Team,  Brown  worked  on  the  Laminar  Soot  Processes, 
Structures  of  Flame  Balls  at  Low  Lewis-number,  and  Water  Mist 
Fire  Suppression  experiments. 

Kalpana  Chawla,  Flight  Engineer  and  Mission  Specialist.  Chawla, 
41,  was  an  aerospace  engineer,  a  FAA  Certified  Flight  Instructor, 
and  a  veteran  of  STS-87.  She  received  a  B.S.  in  Aeronautical  En- 
gineering from  Punjab  Engineering  College,  India,  a  M.S.  in  Aero- 
space Engineering  from  the  University  of  Texas,  Arlington,  and  a 
Ph.D.  in  Aerospace  Engineering  from  the  University  of  Colorado, 
Boulder.  A  member  of  the  Red  Team,  Chawla  worked  with  experi- 
ments on  Astroculture,  Advanced  Protein  Crystal  Facility,  Mechan- 
ics of  Granular  Materials,  and  the  Zeolite  Crystal  Growth  Furnace. 

Laurel  Clark,  Mission  Specialist.  Clark,  41,  was  a  Commander 
(Captain-Select)  in  the  U.S.  Navy  and  a  naval  flight  surgeon.  She 
received  both  a  B.S.  in  Zoology  and  a  M.D.  from  the  University  of 
Wisconsin,  Madison.  A  member  of  the  Red  Team,  Clark  worked  on 
experiments  including  the  Closed  Equilibrated  Biological  Aquatic 
System,  Sleep-Wake  Actigraphy  and  Light  Exposure  During 
Spaceflight,  and  the  Vapor  Compres- 
CREW  ^'""  Distillation  Flight  Flxperiment, 

llan  Rimion,  Payload  Specialist.  Ra- 
mon, 48,  was  a  Colonel  in  the  Israeli 
Air  Force,  a  fighter  pilot,  and  Israel's 
first  astronaut.  Ramon  received  a 
B.S.  in  Electronics  and  Computer 
Engineering  from  the  University  of 
Tel  Aviv,  Israel.  As  a  member  of  the 
Red  Team,  Ramon  was  the  primary 
crew  member  responsible  for  the 
Mediterranean  Israeli  Dust  Experi- 
ment (MEIDEX).  He  also  worked 
on  the  Water  Mist  Fire  Suppression 
and  the  Microbial  Physiology  Flight 
Experiments  Team  experiments, 
amont;  others. 
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nedy  Space  Center  Launch  Control  Team.  Mission  training 
for  the  STS-107  crew  comprised  4,81 1  hours,  with  an  addi- 
tional 3,500  hours  of  payload-specific  training.  The  Ascent/ 
Entry  Flight  Control  Team  began  training  with  the  STS-107 
crew  on  October  22,  2002,  and  participated  in  16  integrated 
ascent  or  entry  simulations.  The  Orbiter  Flight  Control  team 
began  training  with  the  crew  on  April  23,  2002.  participating 
in  six  joint  integrated  simulations  with  the  crew  and  payload 
customers.  Seventy-seven  Flight  Control  Room  operators 
were  assigned  to  four  shifts  for  the  STS-107  mission.  All  had 
prior  certifications  and  had  worked  missions  in  the  past. 

The  STS-107  Launch  Readiness  Review  was  held  on  Decem- 
ber 18,  2002,  at  the  Kennedy  Space  Center.  Neither  NASA 
nor  United  Space  Alliance  noted  any  training  issues  for  launch 
controllers.  The  Mission  Operations  Directorate  noted  no 
crew  or  flight  controller  training  issues  during  the  January 
9.  2003,  STS-107  Flight  Readi'ness  Review.  According  to 
documentation,  all  personnel  were  trained  and  certified,  or 
would  be  trained  and  certified  before  the  flight.  Appendix  D.  I 
contains  a  detailed  STS-107  Training  Report. 

Orbiter  Preparation 

Board  investigators  reviewed  Coltiiiihia's  maintenance,  or 
"flow"  records,  including  the  recovery  from  STS-109  and 
preparation  for  STS-107,  and  relevant  areas  in  NASA's 
Problem  Reporting  and  Corrective  Action  database,  which 
contained  1 6,500  Work  Authorization  Documents  consisting 
of  600,000  pages  and  3.9  million  steps.  This  database  main- 
tains critical  information  on  all  maintenance  and  modifica- 
tion work  done  on  the  Orbiters  (as  required  by  the  Orbiter 
Maintenance  Requirements  and  Specifications  Document). 
It  al.so  maintains  Corrective  Action  Reports  that  document 
problems  discovered  and  resolved,  the  Lost/Found  item  da- 
tabase, and  the  Launch  Readiness  Review  and  Flight  Readi- 
ness Re^view  documentation  (see  Chapter  7). 

The  Board  placed  emphasis  on  maintenance  done  in  areas 
of  particular  concern  to  the  investigation.  Specifically,  re- 
cords for  the  left  main  landing  gear  and  door  assembly  and 
left  wing  leading  edge  were  analyzed  for  any  potential  con- 
tributing factors,  but  nothing  relevant  to  the  cause  of  the 
accident  was  discovered.  A  review  of  Thermal  Protection 
System  tile  maintenance  records  revealed  some  "non-con- 
formances"  and  repairs  made  after  Coliiinbicfs  last  flight, 
but  these  were  eventually  dismissed  as  not  relevant  to  the 
investigation.  Additionally,  the  Launch  Readiness  Review 
and  Flight  Readiness  Review  records  relating  to  those  sys- 
tems and  the  Lost/Found  item  records  were  reviewed,  and 
no  relevance  was  found.  During  the  Launch  Readiness  Re- 
view and  Flight  Readiness  Review  processes,  NASA  teams 
analyzed  18  lost  items  and  deemed  them  inconsequential. 
(Although  this  incident  was  not  considered  significant  by 
the  Board,  a  further  discussion  of  foreign  object  debris 
may  be  found  in  Chapter  4.) 

Payload  Preparation 

The  payload  bay  configuration  for  STS-107  included  the 
SPACEHAB  access  tunnel,  SPACEHAB  Research  Double 
Module  (RDM),  the  FREESTAR  payload,  the  Orbital  Ac- 


SRACEHmB 


Figure  2.1-3.  The  SPACEHAB  Research  Double  Module  as  seen 
from  the  off  fJigfif  deck  windows  of  Columbia  during  S7S-107.  A 
thin  slice  of  Earth's  horizon  is  visible  behind  the  vertical  stabilizer. 


celeration  Research  Experiment,  and  an  Extended  Duration 
Orbiter  pallet  to  accommodate  the  long  flight  time  needed 
to  conduct  all  the  experiments.  Additional  experiments 
were  stowed  in  the  Orbiter  mid-deck  and  on  the  SPACE- 
HAB roof  (see  Figures  2.1-3  and  2.1-4).  The  total  liftoff 
payload  weight  for  STS-107  was  24,536  pounds.  Details  on 
STS-107  payload  preparations  and  on-orbit  operations  are 
in  Appendix  D.2. 

Payload  readiness  reviews  for  STS-107  began  in  May  2002, 
with  no  significant  abnormalities  reported  throughout  the 
processing.  The  final  Pa>load  Safety  Review  Panel  meet- 
ing prior  to  the  mission  was  held  on  January  8,  2003,  at  the 
Kennedy  Space  Center,  where  the  Integrated  Safety  Assess- 
ments conducted  for  the  SPACEHAB  and  FREESTAR  pay- 
loads  were  presented  for  final  approval.  All  payload  physical 
stresses  on  the  Orbiter  were  reported  within  acceptable  lim- 
its. The  Extended  Duration  Orbiter  pallet  was  loaded  into  the 
aft  section  of  the  payload  bay  in  High  Bay  3  of  the  Orbiter 
Processing  Facility  on  April  25.  2002.  The  SPACEHAB 


Report    Vai 


IGUST      2003 


COLUMBIA 

ACCIDENT  INVESTIGATIDN  BOARD 


Figure  2.1-4.  The  configuration 
of  Columbia's  payload  bay  for 
ST^W7. 


and  FREESTAR  payloads  were  loaded  horizontally  on 
March  24,  with  an  Integration  Verification  Test  on  June  6. 
The  payload  bay  doors  were  closed  on  October  31  and  were 
not  opened  prior  to  launch.  (All  late  stow  activities  at  the 
launch  pad  were  accomplished  in  the  vertical  position  using 
the  normal  crew  entry  hatch  and  SPACEHAB  access  tunnel.) 
Rollover  of  the  Orbiterto  the  Vehicle  Assembly  Building  for 
mating  to  the  Solid  Rocket  Boosters  and  External  Tank  oc- 
curred on  November  18.  Mating  took  place  two  days  later, 
and  rollout  to  Launch  Complex  39-A  was  on  December  9. 

Unprecedented  security  precautions  were  in  place  at 
Kennedy  Space  Center  prior  to  and  during  the  launch  of 
STS-107  because  of  prevailing  national  security  concerns 
and  the  inclusion  of  an  Israeli  crew  member. 

SPACEHAB  was  powered  up  at  Launch  minus  51  (L-51) 
hours  (January  14)  to  prepare  for  the  late  stowing  of  time- 
critical  experiments.  The  stowing  of  material  in  SPACE- 
HAB once  it  was  positioned  vertically  took  place  at  L^6 
hours  and  was  completed  by  L-3 1  hours.  Late  middeck  pay- 
load  stowage,  required  for  the  experiments  involving  plants 
and  insects,  was  performed  at  the  launch  pad.  Flight  crew 
equipment  loading  started  at  L-22.5  hours,  while  middeck 
experiment  loading  took  place  from  Launch  minus  19  to  16 
hours.  Fourteen  experiments,  four  of  which  were  powered, 
were  loaded,  all  without  incident. 


2.2    Flight  Preparation 

NASA  senior  management  conducts  a  complex  series  of 
reviews  and  readiness  polls  to  monitor  a  mission's  prog- 
ress toward  flight  readiness  and  eventual  launch.  Each  step 
requires  written  certification.  At  the  final  review,  called  the 
Flight  Readiness  Review,  NASA  and  its  contractors  certify 
that  the  necessary  analyses,  verification  activities,  and  data 
products  associated  with  the  endorsement  have  been  ac- 
complished and  "indicate  a  high  probability  for  mission 
success."  The  review  establishes  the  rationale  for  accepting 
any  remaining  identifiable  risk;  by  signing  the  Certificate  of 
Flight  Readiness,  NASA  senior  managers  agree  that  they 
have  accomplished  all  preliminary  items  and  that  they  agree 
to  accept  that  risk.  The  Launch  Integration  Manager  over- 
sees the  flight  preparation  process. 

STS-107  Flight  Preparation  Process 

The  flight  preparation  process  reviews  progress  toward 
flight  readiness  at  various  junctures  and  ensures  the  organi- 
zation is  ready  for  the  next  operational  phase.  This  process 
includes  Project  Milestone  Reviews,  three  Program  Mile- 
stone Reviews,  and  the  Flight  Readiness  Review,  where  the 
Certification  of  Flight  Readiness  is  endorsed. 

The  Launch  Readiness  Review  is  conducted  within  one 
month  of  the  launch  to  certify  that  Certification  of  Launch 
Readiness  items  from  NSTS-08117,  Appendices  H  and  Q, 
Flight  Preparation  Process  Plan,  have  been  reviewed  and 
acted  upon.  The  STS-107  Launch  Readiness  Review  was 
held  at  Kennedy  Space  Center  on  December  18,  2002. 
The  Kennedy  Space  Center  Director  of  Shuttle  Processing 
chaired  the  review  and  approved  continued  preparations  for 
a  January  16,  2003.  launch.  Onboard  payload  and  experi- 
mental status  and  late  stowage  activity  were  reviewed. 

A  Flight  Readiness  Review,  which  is  chaired  by  the  Of- 
fice of  Space  Flight  Associate  Administrator,  usually  occurs 
about  two  weeks  before  launch  and  provides  senior  NASA 
management  with  a  summary  of  the  certification  and  veri- 
fication of  the  Space  Shuttle  vehicle,  flight  crew,  payloads, 
and  rationales  for  accepting  residual  risk.  In  cases  where 
the  Flight  Preparation  Process  has  not  been  successfully 
completed.  Certification  of  Flight  Readiness  exceptions  will 
be  made,  and  presented  at  the  Pre-Launch  Mission  Manage- 
ment Team  Review  for  disposition.  The  final  Flight  Readi- 
ness Review  for  STS-107  was  held  on  January  9,  2003,  a 
week  prior  to  launch.  Representatives  of  all  organizations 
except  Flight  Crew,  Ferry  Readiness,  and  Department  of 
Defense  Space  Shuttle  Support  made  presentations.  Safety, 
Reliability  &  Quality  Assurance  summarized  the  work  per- 
formed on  the  Ball  Strut  Tie  Rod  Assembly  crack,  defective 
booster  connector  pin,  booster  separation  motor  propellant 
paint  chip  contamination,  and  STS-113  Main  Engine  1 
nozzle  leak  (see  Appendix  E.  1  for  the  briefing  charts).  None 
of  the  work  performed  on  these  items  affected  the  launch. 

Certificate  of  Flight  Readiness:  No  actions  were  assigned 
during  the  Flight  Readiness  Review.  One  exception  was 
included  in  the  Certificate  of  Flight  Readiness  pending  the 
completion  of  testing  on  the  Ball  Strut  Tie  Rod  Assembly. 
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Testing  was  to  be  completed  on  January  15.  This  exception 
was  to  be  closed  witii  final  flight  rationale  at  the  STS-107 
Pre-iaunch  Mission  Management  Team  meeting.  All  princi- 
pal managers  and  organizations  indicated  their  readiness  to 
support  the  mission. 

Normally,  a  Mission  Management  Team  -  consisting  of 
managers  from  Engineering,  System  Integration,  the  Space 
Flight  Operations  Contract  Office,  the  Shuttle  Safety  Office, 
and  the  Johnson  Space  Center  directors  of  flight  crew  opera- 
tions, mission  operations,  and  space  and  life  sciences  -  con- 
venes two  days  before  launch  and  is  maintained  until  the 
Orbiter  safely  lands.  The  Mission  Management  Team  Chair 
reports  directly  to  the  Shuttle  Program  Manager 

The  Mission  Management  Team  resolves  outstanding  prob- 
lems outside  the  responsibility  or  authority  of  the  Launch 
and  Flight  Directors.  During  pre-launch.  the  Mission 
Management  Team  is  chaired  by  the  Launch  Integration 
Manager  at  Kennedy  Space  Center,  and  during  flight  by 
the  Space  Shuttle  Program  Integration  Manager  at  Johnson 
Space  Center.  The  guiding  document  for  Mission  Manage- 
ment operations  is  NSTS  07700.  Volume  VIII. 

A  Pre-launch  Mission  Management  Team  Meeting  oc- 
curs one  or  two  days  before  launch  to  assess  any  open  items 
or  changes  since  the  Flight  Readiness  Review,  provide  a 
GO/NO-GO  decision  on  continuing  the  countdown,  and 
approve  changes  to  the  Launch  Commit  Criteria.  Simul- 
taneously, the  Mission  Management  Team  is  activated  to 
evaluate  the  countdown  and  address  any  issues  remaining 
from  the  Flight  Readiness  Review.  STS-107's  Pre-launch 
Mission  Management  Team  meeting,  chaired  by  the  Acting 
Manager  of  Launch  Integration,  was  held  on  January  14, 
some  48  hours  prior  to  launch,  at  the  Kennedy  Space  Cen- 
ter. In  addition  to  the  standard  topics,  such  as  weather  and 
range  support,  the  Pre-Launch  Mission  Management  Team 
was  updated  on  the  status  of  the  Ball  Strut  Tie  Rod  Assem- 
bly testing.  The  exception  would  remain  open  pending  the 
presentation  of  additional  test  data  at  the  Delta  Pre-Launch 
Mission  Management  Team  review  the  next  day. 

The  Delta  Pre-Launch  Mission  Management  Team  Meet- 
ing was  also  chaired  by  the  Acting  Manager  of  Launch  Inte- 
gration and  met  at  9:00  a.m.  EST  on  January  15  at  the  Ken- 
nedy Space  Center  The  major  issues  addressed  concerned 
the  Ball  Strut  Tie  Rod  Assembly  and  potential  strontium 
chromate  contamination  found  during  routine  inspection  of 
a  (non-STS-107)  spacesuit  on  January  14.  The  contamina- 
tion concern  was  addressed  and  a  toxicology  analysis  de- 
termined there  was  no  risk  to  the  STS-107  crew.  A  poll  of 
the  principal  managers  and  organizations  indicated  all  were 
ready  to  support  STS-107. 

A  Pre-Tanking   Mission   Management  Team   Meeting 

was  also  chaired  by  the  Acting  Manager  of  Launch  Integra- 
tion. This  meeting  was  held  at  12:10  a.m.  on  January  16. 
A  problem  with  the  Solid  Rocket  Booster  External  Tank  At- 
tachment ring  was  addressed  for  the  first  time.  Recent  mis- 
sion life  capability  testing  of  the  material  in  the  ring  plates 
revealed  static  strength  properties  below  minimum  require- 
ments. There  were  concerns  that,  assuming  worst-case  flight 
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Like  most  engineering  or  technical  operations,  NASA 
generally  uses  Coordinated  Universal  Time  (UTC, 
formerly  called  Greenwich  Mean  Time)  as  the  standard 
reference  for  activities.  This  is,  for  convenience,  often 
converted  to  local  time  in  either  Florida  or  Texas  -  this 
report  uses  Eastern  Standard  Time  (EST)  unless  other- 
wise noted.  In  addition  to  the  normal  24-hour  clock, 
NASA  tells  time  via  several  other  methods,  all  tied  to 
specific  events.  The  most  recognizable  of  these  is  "T 
minus  (T-)"  time  that  counts  down  to  every  launch  in 
hours,  minutes,  and  seconds.  NASA  also  uses  a  less 
precise  "L  minus"  (L-)  time  that  tags  events  that  hap- 
pens days  or  weeks  prior  to  launch.  Later  in  this  report 
there  are  references  to  "Entiy  Interface  plus  (El-i-)"  time 
that  counts,  in  seconds,  from  when  an  Orbiter  begins  re- 
entry. In  all  ca.ses,  if  the  time  is  "minus"  then  the  event 
being  counted  toward  has  not  happened  yet;  if  the  time 
is  "plus"  then  the  event  has  already  occurred. 


environments,  the  ring  plate  would  not  meet  the  safety  factor 
requirement  of  1.4  -  that  is,  able  to  withstand  1.4  times  the 
maximum  load  expected  in  operation.  Based  on  analysis  of 
the  anticipated  flight  environment  for  STS-107,  the  need  to 
meet  the  safety  factor  requirement  of  1.4  was  waived  (see 
Chapter  10).  No  Launch  Commit  Criteria  violations  were 
noted,  and  the  STS-107  final  countdown  began.  The  loading 
of  propel lants  into  the  External  Tank  was  delayed  by  some 
70  minutes,  until  seven  hours  and  20  minutes  before  launch, 
due  to  an  extended  fuel  cell  calibration,  a  liquid  oxygen 
replenish  valve  problem,  and  a  Launch  Processing  System 
reconfiguration.  The  countdown  continued  normally,  and  at 
T-9  minutes  tlje  Launch  Mission  Management  Team  was 
polled  for  a  GO/NO-GO  launch  decision.  All  members  re- 
ported GO,  and  the  Acting  Manager  of  Launch  Integration 
gave  the  final  GO  launch  decision. 

Once  the  Orbiter  clears  the  launch  pad,  responsibility  passes 
from  the  Launch  Director  at  the  Kennedy  Space  Center  to 
the  Flight  Director  at  Johnson  Space  Center  During  flight, 
the  mission  is  also  evaluated  from  an  engineering  perspec- 
tive in  the  Mission  Evaluation  Room,  which  is  managed 
by  Vehicle  Engineering  Office  personnel.  Any  engineering 
analysis  conducted  during  a  mission  is  coordinated  through 
and  first  presented  to  the  Mission  Evaluation  Room,  and  is 
then  presented  by  the  Mission  Evaluation  Room  manager  to 
the  Mission  Management  Team. 

2.3    Launch  Sequence 

The  STS-107  launch  countdown  was  scheduled  to  be  about 
24  hours  longer  than  usual,  primarily  because  of  the  extra 
time  required  to  load  cryogens  for  generating  electricity 
and  water  into  the  Extended  Duration  Orbiter  pallet,  and 
for  final  stowage  of  plants,  insects,  and  other  unique  science 
payloads.  SPACEHAB  stowage  activities  were  about  90 
minutes  behind  schedule,  but  the  overall  launch  countdown 
was  back  on  schedule  when  the  communication  system 
check  was  completed  at  L-24  hours. 
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At  7  hours  and  20  minutes  prior  to  the  scheduled  launch  on 
January  16,  2003.  ground  crews  began  filling  the  External 
Tank  with  over  1.500.000  pounds  of  cryogenic  propellants. 
At  about  6:15  a.m..  the  Final  Inspection  Team  began  its  vi- 
sual and  photographic  check  of  the  launch  pad  and  vehicle. 
Frost  had  been  noted  during  earlier  inspections,  but  it  had 
dissipated  by  7:15  a.m..  when  the  Ice  Team  completed  its 
inspection. 

Heavy  rain  had  fallen  on  Kennedy  Space  Center  while 
the  Shuttle  stack  was  on  the  pad.  The  launch-day  weather 
was  65  degrees  Fahrenheit  with  68  percent  relative  humid- 
ity, dew  point  59  degrees,  calm  winds,  scattered  clouds  at 
4.000  feet,  and  visibility  of  seven  statute  miles.  The  fore- 
cast weather  for  Kennedy  Space  Center  and  the  Transoce- 
anic Abort  Landing  sites  in  Spain  and  Morocco  was  within 
launch  criteria  limits. 

At  about  7:.^0  a.m.  the  crew  was  driven  from  their  quarters 
in  the  Kennedy  Space  Center  Industrial  Area  to  Launch 
Complex  39-A.  Commander  Rick  Husband  was  the  first 
crew  member  to  enter  Coliiiiihiii.  at  the  195-foot  level  of 
the  launch  tower  at  7:53  a.m.  Mission  Specialist  Kalpana 
Chawla  was  the  last  to  enter,  at  8:45  a.m.  The  hatch  was 
closed  and  locked  at  9:17  a.m. 

The  countdown  clock  e.xecuted  the  planned  hold  at  the  T-20 
minute-mark  at  10:10  a.m.  The  primary  ascent  computer 
software  was  switched  over  to  the  launch-ready  configura- 
tion, communications  checks  were  completed  with  all  crew 
members,  and  all  non-essential  personnel  were  cleared  from 
the  launch  area  at  10:16  a.m.  Fifteen  minutes  later  the  count- 
down clock  came  out  of  the  planned  hold  at  the  T-9  minutes, 
and  at  10:35  a.m.,  the  GO  was  given  for  Auxiliary  Power 
Unit  start.  STS-107  began  at  10:39  a.m.  with  ignition  of  the 
Solid  Rocket  Boosters  (.see  Figure  2.3-1  ). 


Wind  Shear 

Before  a  launch,  balloons  are  released  to  detemiine  the  di- 
rection and  speed  of  the  winds  up  to  50.000  to  60,000  feet. 
Various  Doppler  sounders  are  alsi)  used  to  get  a  wind  profile, 
which,  for  STS- 107,  was  unremarkable  and  relatively  constant 
at  the  lower  altitudes. 

Columbia  encountered  a  wind  shear  about  57  seconds 
after  launch  during  the  period  of  maximum  dynamic  pres- 
sure (max-q).  As  the  Shuttle  passed  through  32,000  feet,  it 
experienced  a  rapid  change  in  the  out-of-plane  wind  speed 
of  minus  37.7  feet  per  second  over  a  1.200-foot  altitude 
range.  Immediately  after  the  vehicle  flew  through  this  alti- 
tude range,  its  sideslip  (beta)  angle  began  to  increase  in  the 
negative  direction,  reaching  a  value  of  minus  1.75  degrees 
at  60  seconds. 

A  negative  beta  angle  means  that  the  wind  vector  was  on 
the  left  side  of  the  vehicle,  pushing  the  nose  to  the  right 
and  increasing  the  aerodynamic  force  on  the  External  Tank 
bipod  stiTJt  attachment.  Several  studies  have  indicated  that 
the  aerodynamic  loads  on  the  External  Tank  forward  attach 
bipod,  and  also  the  interacting  aerodynamic  loads  between 
the  External  Tank  and  the  Orbiter,  were  larger  than  normal 
but  within  design  limits. 

Predicted  and  Actual  l-Loads 

On  launch  day,  the  General-Purpose  Computers  on  the  Or- 
biter are  updated  with  information  based  on  the  latest  obser- 
vations of  weather  and  the  physical  properties  of  the  vehicle. 
These  "I-loads"  are  initializing  data  sets  that  contain  ele- 
ments specific  to  each  mission,  such  as  measured  winds,  at- 
mospheric data,  and  Shuttle  configuration.  The  I-loads  output 
target  angle  of  attack,  angle  of  sideslip,  and  dynamic  pressure 
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as  a  function  of  Mach  number  to  ensure  that  the  structural 
loads  the  Shuttle  experiences  during  ascent  are  acceptable. 

After  the  accident,  investigators  analyzed  Columbia's  as- 
cent loads  using  a  reconstruction  of  the  ascent  trajectory. 
The  wing  loads  measurement  used  a  flexible  body  structural 
loads  assessment  that  was  validated  by  data  from  the  Modu- 
lar Auxiliary  Data  System  recorder,  which  was  recovered 
from  the  accident  debris.  The  wing  loads  assessment  includ- 
ed crosswind  effects,  angle  of  attack  (alpha)  effects,  angle  of 
sideslip  (beta)  effects,  normal  acceleration  (g),  and  dynamic 
pressure  (q)  that  could  produce  stresses  and  strains  on  the 
Orbiter's  wings  during  ascent.  This  assessment  showed  that 
all  Orbiter  wing  loads  were  approximately  70  percent  of 
their  design  limit  or  less  throughout  the  ascent,  including  the 
previously  mentioned  wind  shear. 

The  wind  shear  at  37  seconds  after  launch  and  the  Shuttle 
stack's  reaction  to  it  appears  to  have  initiated  a  very  low 
frequency  oscillation,  caused  by  liquid  oxygen  sloshing  in- 
side the  External  Tank,""  that  peaked  in  amplitude  75  seconds 
after  launch  and  continued  through  Solid  Rocket  Booster 
separation  at  127  seconds  after  launch.  A  small  oscillation 
is  not  unusual  during  ascent,  but  on  STS-107  the  amplitude 
was  larger  than  normal  and  lasted  longer.  Less  severe  wind 
shears  at  95  and  105  seconds  after  launch  contributed  to  the 
continuing  oscillation. 

An  analysis  of  the  External  Tank/Orbiter  interface  loads, 
using  simulated  wind  shear,  crosswind,  beta  effects,  and 
liquid  oxygen  slosh  effects,  showed  that  the  loads  on  the 
External  Tank  forward  attachment  were  only  70  percent 
of  the  design  certification  limit.  The  External  Tank  slosh 
study  confirmed  that  the  flight  control  system  provided 
adequate  stability  throughout  ascent. 

The  aerodynamic  loads  on  the  External  Tank  forward  attach 
bipod  were  analyzed  using  a  Computational  Fluid  Dynamics 
simulation,  that  yielded  axial,  side-force,  and  radial  loads, 
and  indicated  that  the  external  air  loads  were  well  below  the 
design  limit  during  the  period  of  maximum  dynamic  pres- 
sure and  also  when  the  bipod  foam  separated. 

Nozzle  Deflections 

Both  Solid  Rocket  Boosters  and  each  of  the  Space  Shuttle 
Main  Engines  have  exhaust  nozzles  that  deflect  ("gimbal") 
in  response  to  flight  control  system  commands.  Review  of 
the  STS-107  ascent  data  revealed  that  the  Solid  Rocket 
Booster  and  Space  Shuttle  Main  Engine  nozzle  positions 
twice  exceeded  deflections  seen  on  previous  flights  by  a 
factor  of  1.24  to  1.33  and  1.06,  respectively.  The  center 
and  right  main  engine  yaw  deflections  first  exceeded  those 
on  previous  flights  during  the  period  of  maximum  dynamic 
pressure,  immediately  following  the  wind  shear.  The  de- 
flections were  the  flight  control  system's  reaction  to  the 
wind  shear,  and  the  motion  of  the  nozzles  was  well  within 
the  design  margins  of  the  flight  control  system. 

Approximately  1 15  seconds  after  launch,  as  booster  thrust 
diminished,  the  Solid  Rocket  Booster  and  Space  Shuttle 
Main  Engine  exhaust  nozzle  pitch  and  yaw  deflections  ex- 


ceeded those  seen  previously  by  a  factor  of  1.4  and  1.06  to 
1.6,  respectively.  These  deflections  were  caused  by  lower 
than  expected  Reusable  Solid  Rocket  Motor  performance, 
indicated  by  a  low  burn  rate;  a  thrust  mismatch  between 
the  left  and  right  boosters  caused  by  lower-than-normal 
thrust  on  the  right  Solid  Rocket  Booster;  a  small  built-in 
adjustment  that  favored  the  left  Solid  Rocket  Booster  pitch 
actuator;  and  flight  control  trim  characteristics  unique  to  the 
Performance  Enhancements  flight  profile  for  STS-107.^ 

The  Solid  Rocket  Booster  burn  rate  is  temperature-depen- 
dent, and  behaved  as  predicted  for  the  launch  day  weather 
conditions.  No  two  boosters  bum  exactly  the  same,  and  a 
minor  thrust  mismatch  has  been  experienced  on  almost 
every  Space  Shuttle  mission.  The  booster  thrust  mismatch 
on  STS-107  was  well  within  the  design  margin  of  the  flight 
control  system. 

Debris  Strike 

Post-launch  photographic  analysis  showed  that  one  large 
piece  and  at  lea,st  two  smaller  pieces  of  insulating  foam 
separated  from  the  External  Tank  left  bipod  (-Y)  ramp  area 
at  81 .7  seconds  after  launch.  Later  analysis  showed  that  the 
larger  piece  struck  Colitiiihia  on  the  underside  of  the  left 
wing,  around  Reinforced  Carbon-Carbon  (RCC)  panels  5 
through  9,  at  81.9  seconds  after  launch  (see  Figure  2.3-2). 
Further  photographic  analysis  conducted  the  day  after 
launch  revealed  that  the  large  foam  piece  was  approximately 
21  to  27  inches  long  and  12  to  18  inches  wide,  tumbling  at 
a  minimum  of  1 8  times  per  second,  and  moving  at  a  relative 
velocity  to  the  Shuttle  Stack  of  625  to  840  feet  per  second 
(416  to  573  miles  per  hour)  at  the  time  of  impact. 


Figure    2.3-2.    A    sfiower    of   foam    debris    offer   fhe    impact   on 
Columbia's  left  wing.  The  event  was  nof  observed  in  real  time. 
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Arrival  on  Orbit 

Two  minutes  and  seven  seconds  after  launch,  the  Solid 
Rocket  Boosters  separated  from  the  External  Tank.  They 
made  a  normal  splashdown  in  the  Atlantic  Ocean  and  were 
subsequently  recovered  and  returned  to  the  Kennedy  Space 
Center  for  inspection  and  refurbishment.  Approximately 
eight  and  a  half  minutes  after  launch,  the  Space  Shuttle  Main 
Engines  shut  down  normally,  followed  by  the  separation  of 
the  Externa!  Tank.  .At  1 1:20  a.m.,  a  two-minute  burn  of  the 
Orbital  Maneuvering  System  engines  began  to  position 
Coluiithia  in  its  proper  orbit,  inclined  39  degrees  to  the 
equator  and  approximately  175  miles  above  Earth. 

2.4    On-Orbit  Events 

By  1 1 :39  a.m.  EST,  one  hour  after  launch,  Columbia  was  in 
orbit  and  crew  members  entered  the  "post-insertion  time- 
line." The  crew  immediately  began  to  configure  onboard 
systems  for  their  1 6-day  stay  in  space. 

Flight  Day  1,  Thursday,  January  16 

The  payload  bay  doors  were  opened  at  12:36  p.m.  and  the 
radiator  was  deployed  for  cooling.  Crew  members  activated 
the  Extended  Duration  Orbiter  pallet  (containing  extra  pro- 
pellants  for  power  and  water  production)  and  FREESTAR, 
and  they  began  to  set  up  the  SPACEHAB  module  (see  Fig- 
ure 2.4-1 ).  The  crew  then  ran  two  experiments  with  the  Ad- 
vanced Respiratory  Monitoring  System  stationary  bicycle  in 
SPACEHAB. 

The  crew  also  set  up  the  Bioreactor  Demonstration  System, 
Space  Technology  and  Research  Students  Bootes,  Osteopo- 
rosis Experiment  in  Orbit,  Closed  Equilibrated  Biological 
Aquatic  System,  Miniature  Satellite  Threat  Reporting  Sys- 
tem, and  Biopack,  and  performed  Low  Power  Transceiver 
communication  tests. 

Flight  Day  2,  Friday,  January  17 

The  Ozone  Limb  Sounding  Experiment  2  began  measuring 
the  ozone  layer,  while  the  Mediterranean  Israeli  Dust  Ex- 
periment (MEIDEX)  was  set  to  measure  atmospheric  aero- 
sols over  the  Mediterranean  Sea  and  the  Sahara  Desert.  The 
Critical  Viscosity  of  Xenon  2  experiment  began  studying  the 
fluid  properties  of  Xenon. 

The  crew  activated  the  SPACEHAB  Centralized  Experiment 
Water  Loop  in  preparation  for  the  Combustion  Module  2  and 
Vapor  Compression  Distillation  Flight  Experiment  and  also 
activated  the  Facility  for  Absorption  and  Surface  Tension, 
Zeolite  Crystal  Growth,  Astroculture,  Mechanics  of  Granu- 
lar Materials,  Combined  Two  Phase  Loop  Experiment, 
European  Research  In  Space  and  Terrestrial  Osteoporosis, 
Biological  Research  in  Canisters,  centrifuge  configurations. 
Enhanced  Orbiter  Refrigerator/Freezer  Operations,  and  Mi- 
crobial Physiological  Flight  Experiment. 

Not  known  to  Mission  Control,  the  Columbia  crew,  or  anyone 
else,  between  10:30  and  1 1 :00  a.m.  on  Flight  Day  2,  an  object 
drifted  away  from  the  Orbiter  This  object,  which  subsequent 


analysis  suggests  may  have  been  related  to  the  debris  strike, 
had  a  departure  velocity  between  0.7  and  3.4  miles  per  hour, 
remained  in  a  degraded  orbit  for  approximately  two  and  a 
half  days,  and  re-entered  the  atmosphere  between  8:45  and 
1 1:45  p.m.  on  January  19.  This  object  was  discovered  after 
the  accident  when  Air  Force  Space  Command  reviewed  its  ra- 
dar tracking  data.  (See  Chapter  3  for  additional  discussion.) 

Flight  Day  3,  Saturday,  January  18 

The  crew  conducted  its  first  on-orbit  press  conference.  Be- 
cause of  heavy  cloud  cover  over  the  Middle  East,  MEIDEX 
objectives  could  not  be  accomplished.  Crew  members  began 
an  experiment  to  track  metabolic  changes  in  their  calcium 
levels.  The  crew  resolved  a  discrepancy  in  the  SPACEHAB 
Video  Switching  Unit,  provided  body  fluid  samples  for  the 
Physiology  and  Biochemistry  experiment,  and  activated  the 
Vapor  Compression  Distillation  Flight  Experiment. 


Figure  2.4-1.  The  tunnel  linking  the  SPACEHAB  module  fo  the 
Columbia  crew  compartment  provides  a  view  of  Kalpana  Chawla 
worlc/ng  in  SPACEHAB. 


Flight  Day  4,  Sunday,  January  19 

Husband.  Chawla.  Clark,  and  Ramon  completed  the  first  ex- 
periments with  the  Combustion  Module  2  in  SPACEHAB, 
which  were  the  Laminar  Soot  Processes,  Water  Mist  Fire 
suppression,  and  Structure  of  Flame  Balls  at  Low  Lewis 
number.  The  latter  studied  combustion  at  the  limits  of  flam- 
mability.  producing  the  weakest  flame  ever  to  burn:  each 
flame  produced  one  watt  of  thermal  power  (a  birthday-cake 
candle,  by  comparison,  produces  50  watts). 

Experiments  on  the  human  body's  response  to  microgravity 
continued,  with  a  focus  on  protein  manufacturing,  bone  and 
calcium  production,  renal  stone  formation,  and  saliva  and 
urine  changes  due  to  viruses.  Brown  captured  the  first  ever 
images  of  upper-atmosphere  "sprites"  and  "elves."  which 
are  produced  by  intense  cloud-to-ground  electromagnetic 
impulses  radiated  by  heavy  lightning  discharges  and  are  as- 
sociated with  storms  near  the  Earth's  surface. 
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The  crew  reported  about  a  cup  of  water  under  the  SPACE- 
HAB  module  sub-floor  and  significant  amounts  clinging 
to  the  Water  Separator  Assembly  and  Aft  Power  Distribu- 
tion Unit.  The  water  was  mopped  up  and  Mission  Control 
switched  power  from  Rotary  Separator  I  to  2. 

Flight  Day  5,  Monday,  January  20 

Mission  Control  saw  indications  of  an  electrical  short  on 
Rotary  Separator  2  in  SPACEHAB;  the  separator  was  pow- 
ered down  and  isolated  from  the  electrical  bus.  To  reduce 
condensation  with  both  Rotary  Separators  off,  the  crew 
had  to  reduce  the  flow  in  one  of  Columbia's  Freon  loops  to 
SPACEHAB  in  order  to  keep  the  water  temperature  above 
the  dew  point  and  prevent  condensation  from  forming  in  the 
Condensing  Heat  Exchanger.  However,  warmer  water  could 
lead  to  higher  SPACEHAB  cabin  temperatures;  fortunately, 
the  crew  was  able  to  keep  SPACEHAB  temperatures  accept- 
able and  avoid  condensation  in  the  heat  exchanger. 

Flight  Day  6,  Tuesday,  January  21 

The  temperature  in  the  SPACEHAB  module  reached  81  de- 
grees Fahranhcil.  The  crew  reset  the  temperature  to  accept- 
able levels,  and  Mission  Control  developed  a  contingency 
plan  to  re-establish  SPACEHAB  humidity  and  temperature 
control  if  further  degradation  occuired.  The  Miniature  Satel- 
lite Threat  Reporting  System,  which  detects  ground-based 
radio  frequency  sources,  experienced  minor  command  and 
telemetry  problems. 

Flight  Day  7,  Wednesday,  January  22 

Both  teams  took  a  half  day  off.  MEIDEX  tracked  thunder- 
storms over  central  Africa  and  captured  images  of  four  sprites 
and  two  elves  as  well  as  two  rare  images  of  meteoroids  enter- 
ing Earth's  atmosphere.  Payload  experiments  continued  in 
SPACEHAB,  with  no  further  temperature  complications. 

Flight  Day  8,  Thursday,  January  23 

Eleven  educational  events  were  completed  using  the  low- 
power  transceiver  to  transfer  data  files  to  and  from  schools 
in  Maryland  and  Massachusetts.  The  Mechanics  of  Granular 
Materials  experiment  completed  the  sixth  of  nine  tests.  Bio- 
pack  shut  down,  and  attempts  to  recycle  the  power  were  un- 
successful; ground  teams  began  developing  a  repair  plan. 

Mission  Control  e-mailed  Husband  and  McCool  that  post- 
launch  photo  analysis  showed  foam  from  the  External  Tank 
had  struck  the  Orbiter's  left  wing  during  ascent.  Mission 
Control  relayed  that  there  was  "no  concern  for  RCC  or  tile 
damage'"  and  because  the  phenomenon  had  been  seen  be- 
fore, there  was  "absolutely  no  concern  for  entry."  Mission 
Control  also  e-mailed  a  short  video  clip  of  the  debris  strike, 
which  Husband  forwarded  to  the  rest  of  the  crew. 

Flight  Day  9,  Friday,  January  24 

Crew  members  conducted  the  mission's  longest  combustion 
test.  Spiral  moss  growth  experiments  continued,  as  well  as 
Astroculture  experiments  that  harvested  samples  of  oils  from 


roses  and  rice  flowers.  Experiments  in  the  combustion  cham- 
ber continued.  Although  the  temperature  in  SPACEHAB  was 
maintained.  Mission  Control  estimated  that  about  a  half-gal- 
lon of  water  was  unaccounted  for,  and  began  planning  in- 
flight maintenance  for  the  Water  Separator  Assembly. 


Davtd  Brown  sfabilizes  a  digital  video  camera  prior  fo  a  press 
conference  in  the  SPACEHAB  Research  Double  Module  aboard 
Columbia  during  STS-107. 


Flight  Day  10,  Saturday,  January  25 

Experiments  with  bone  cells,  prostate  cancer,  bacteria 
growth,  thermal  heating,  and  surface  tension  continued. 
MEIDEX  captured  images  of  plumes  of  dust  off  the  coasts 
of  Nigeria,  Mauritania,  and  Mali.  Images  of  sprites  were 
captured  over  storms  in  Perth,  Australia.  Biopack  power 
could  not  be  restored,  so  all  subsequent  Biopack  sampling 
was  performed  at  ambient  temperatures. 

Flight  Day  11,  Sunday,  January  26 

Vapor  Compression  Distillation  Flight  Experiment  opera- 
tions were  complete;  SPACEHAB  temperature  was  allowed 
to  drop  to  73  degrees  Fahrenheit.  Scientists  received  the  first 
live  Xybion  digital  downlink  images  from  MEIDEX  and 
confirmed  significant  dust  in  the  Middle  East.  The  STARS 
experiment  hatched  a  fish  in  the  aquatic  habitat  and  a  silk 
moth  from  its  cocoon. 

Flight  Day  12,  Monday,  January  27 

Combustion  and  granular  materials  experiments  concluded. 
The  combustion  module  was  configured  for  the  Water  Mist 
experiment,  which  developed  a  leak.  The  Microbial  Physiol- 
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ogy  Right  Experiment  expended  its  final  set  of  samples  in 
yeast  and  bacteria  growth.  The  crew  made  a  joint  observa- 
tion using  MEIDEX  and  the  Ozone  Limb  Sounding  Experi- 
ment. MEIDEX  captured  images  of  dust  over  the  Atlantic 
Ocean  for  the  first  time. 

Flight  Day  13,  Tuesday,  January  28 

The  crew  took  another  half  day  off.  The  Bioreactor  experi- 
ment produced  a  bone  and  prostate  cancer  tumor  tissue  sam- 
ple the  size  of  a  golf  ball,  the  largest  ever  grown  in  space. 
The  crew,  along  with  ground  support  personnel,  observed 
a  moment  of  silence  to  honor  the  memory  of  the  men  and 
women  of  Apollo  J  and  Challenger.  MEIDE.X  was  prepared 
to  monitor  smoke  trails  from  research  aircraft  and  bonfires 
in  Brazil.  Water  Mist  nms  began  after  the  leak  was  stopped. 

Flight  Day  14,  Wednesday,  January  29 

Ramon  reported  a  giant  dust  storm  over  the  Atlantic  Ocean 
that  provided  three  days  of  MEIDEX  observations.  Ground 
teams  confirmed  predicted  weather  and  climate  effects  and 
found  a  huge  smoke  plume  in  a  large  cuinulus  cloud  over 
the  Amazon  jungle.  BIOTUBE  experiment  ground  teams 
reported  growth  rates  and  root  curvatures  in  plant  and  flax 
roots  different  from  anything  seen  in  normal  gravit\'  on 
Earth.  The  crew  received  procedures  from  Mission  Con- 
trol for  vacuum  cleanup  and  taping  of  the  Water  Separator 
Assembly  prior  to  re-entr>.  Temperatures  in  two  Biopack 
culture  chambers  were  too  high  for  normal  cell  growth,  so 
several  Biopack  experiments  were  terminated. 

Flight  Day  15,  Thursday,  January  30 

Final  samples  and  readings  were  taken  for  the  Physiology 
and  Biochemistry  team  experiments.  Husband,  McCool,  and 
Chawla  ran  landing  simulations  on  the  computer  training 
system.  Husband  found  no  excess  water  in  the  SPACEHAB 
sub-floor,  but  as  a  precaution,  he  covered  several  holes  in  the 
Water  Separator  Assembly. 

Flight  Day  16,  Friday,  January  31 

The  Water  Mist  Experiment  concluded  and  the  combustion 
module  was  closed.  MEIDEX  made  final  observations  of 
dust  concentrations,  sprites,  and  elves.  Husband,  McCool. 
and  Chawla  completed  their  second  computer-based  landing 
simulation.  A  flight  control  system  checkout  was  performed 
satisfactorily  using  Auxiliary  Power  Unit  1.  with  a  run  time 
of  5  minutes,  27  seconds. 

After  the  flight  control  system  checkout,  a  Reaction  Control 
System  "hot-fire"  was  performed  during  which  all  thrust- 
ers  were  fired  for  at  least  240  milliseconds.  The  Ku-band 
antenna  and  the  radiator  on  the  left  payload  bay  door  were 
stowed. 

Flight  Day  17,  Saturday,  February  1 

Ail  onboard  experiments  were  concluded  and  stowed,  and 
payload  doors  and  covers  were  closed.  Preparations  were 
completed  for  de-orbit,  re-entry,  and  landing  at  the  Kennedy 


Rick  Husband  works  with  the  Biological  Research  in  Canister  ex- 
periment on  Columbia's  mid-declc. 


Space  Center  Suit  checks  confirmed  that  proper  pressure 
would  be  maintained  during  re-entry  and  landing.  The  pay- 
load  bay  doors  were  closed.  Husband  and  McCool  config- 
ured the  onboard  computers  with  the  re-entry  software,  and 
placed  Columhki  in  the  proper  attitude  for  the  de-orbit  burn. 

2.5    Debris  Strike  Analysis 
AND  Requests  for  Imagery 

As  is  done  after  every  launch,  within  two  hours  of  the  lift- 
off the  Intercenter  Photo  Working  Group  examined  video 
from  tracking  cameras.  An  initial  review  did  not  reveal  any 
unusual  events.  The  next  day.  when  the  Intercenter  Photo 
Working  Group  personnel  received  much  higher  resolution 
film  that  had  been  processed  overnight,  they  noticed  a  debris 
strike  at  8 1 .9  seconds  after  launch. 

A  large  object  from  the  left  bipod  area  of  the  External  Tank 
struck  the  Orbiter,  apparently  impacting  the  underside  of  the 
left  wing  near  RCC  panels  3  through  9.  The  object's  large 
size  and  the  apparent  momentum  transfer  concerned  Inter- 
center Photo  Working  Group  personnel,  who  were  worried 
that  Coliiinhia  had  sustained  damage  not  detectable  in  the 
limited  number  of  views  their  tracking  cameras  captured. 
This  concern  led  the  Intercenter  Photo  Working  Group  Chair 
to  request,  in  anticipation  of  analysts'  needs,  that  a  high- 
resolution  image  of  the  Orbiter  on-orbit  be  obtained  by  the 
Department  of  Defense.  By  the  Board's  count,  this  would 
be  the  first  of  three  distinct  requests  to  image  Columbia 
on-orbit.  The  exact  chain  of  events  and  circumstances  sur- 
rounding the  movement  of  each  of  these  requests  through 
Shuttle  Program  Management,  as  well  as  the  ultimate  denial 
of  these  requests,  is  a  topic  of  Chapter  6. 

After  discovering  the  strike,  the  Intercenter  Photo  Working 
Group  prepared  a  report  with  a  video  clip  of  the  impact  and 
sent  it  to  the  Mission  Management  Team,  the  Mission  Evalu- 
ation Room,  and  engineers  at  United  Space  Alliance  and 
Boeing.  In  accordance  with  NASA  guidelines,  these  contrac- 
tor and  NASA  engineers  began  an  assessment  of  potential 
impact  damage  to  Coliiinhia\  left  wing,  and  soon  formed  a 
Debris  Assessment  Team  to  conduct  a  formal  review. 
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The  first  formal  Debris  Assessment  Team  meeting  was  held 
on  January  21,  five  days  into  the  mission.  It  ended  with  the 
highest-ranking  NASA  engineer  on  the  team  agreeing  to 
bring  the  team's  request  for  imaging  of  the  wing  on-orbit, 
which  would  provide  better  information  on  which  to  base 
their  analysis,  to  the  Johnson  Space  Center  Engineering 
Management  Directorate,  with  the  expectation  the  request 
would  go  forward  to  Space  Shuttle  Program  managers.  De- 
bris Assessment  Team  members  subsequently  learned  that 
these  managers  declined  to  image  Columbia. 

Without  on-orbit  pictures  of  Coliiiiihici,  the  Debris  Assess- 
ment Team  was  restricted  to  using  a  mathematical  modeling 
tool  called  Crater  to  assess  damage,  although  it  had  not  been 
designed  with  this  type  of  impact  in  mind.  Team  members 
concluded  over  the  next  six  days  that  some  localized  heating 
damage  would  most  likely  occur  during  re-entry,  but  they 
could  not  definitively  state  that  structural  damage  would 
result.  On  January  24,  the  Debris  Assessment  Team  made  a 
presentation  of  these  results  to  the  Mission  Evaluation  Room, 
whose  manager  gave  a  verbal  summary  (with  no  data)  of  that 
presentation  to  the  Mission  Management  Team  the  same  day. 
The  Mission  Management  Team  declared  the  debris  strike  a 
"turnaround'"  issue  and  did  not  pursue  a  request  for  imagery. 

Even  after  the  Debris  Assessment  Team's  conclusion  had 
been  reported  to  the  Mission  Management  Team,  engineers 
throughout  NASA  and  Mission  Control  continued  to  ex- 
change e-mails  and  discuss  possible  damage.  These  messag- 
es and  discussions  were  generally  sent  only  to  people  within 
the  senders'  area  of  expertise  and  level  of  seniority. 


William  McCool  folks  to  Mission  Confro/  from  fbe  off  flight  deck  of 
Columbia  during  STS-107. 


2.6    De-Orbit  Burn  and  Re-Entry  Events 

At  2:30  a.m.  EST  on  Februai-y  1.  2003,  the  Entry  Flight 
Control  Team  began  duty  in  the  Mission  Control  Center. 
The  Flight  Control  Team  was  not  working  any  issues  or 
problems  related  to  the  planned  de-orbit  and  re-entry  of 
Columbia.  In  particular,  the  team  indicated  no  concerns 
about  the  debris  impact  to  the  left  wing  during  ascent,  and 
treated  the  re-entry  like  any  other. 


The  team  worked  through  the  de-orbit  preparation  checklist 
and  re-entry  checklist  procedures.  Weather  forecasters,  with 
the  help  of  pilots  in  the  Shuttle  Training  Aircraft,  evaluated 
landing  site  weather  conditions  at  the  Kennedy  Space  Cen- 
ter. At  the  time  of  the  de-orbit  decision,  about  20  minutes 
before  the  initiation  of  the  de-orbit  burn,  all  weather  obser- 
vations and  forecasts  were  within  guidelines  set  by  the  flight 
rules,  and  all  systems  were  normal. 

Shortly  after  8:00  a.m.,  the  Mission  Control  Center  Entiy 
Flight  Director  polled  the  Mission  Control  room  for  a  GO/ 
NO-GO  decision  for  the  de-orbit  burn,  and  at  8: 10  a.m.,  the 
Capsule  Communicator  notified  the  crew  they  were  GO  for 
de-orbit  burn. 

As  the  Orbiter  flew  upside  down  and  tail-first  over  the  In- 
dian Ocean  at  an  altitude  of  175  statute  miles.  Commander 
Husband  and  Pilot  McCool  executed  the  de-orbit  burn  at 
8:15:30  a.m.  using  Columbia'!^  two  Orbital  Maneuvering 
System  engines.  The  de-orbit  maneuver  was  performed  on 
the  255th  orbit,  and  the  2-minute,  38-second  burn  slowed 
the  Orbiter  from  17,500  mph  to  begin  its  re-entry  into  the 
atmosphere.  During  the  de-orbit  burn,  the  crew  felt  about 
10  percent  of  the  effects  of  gravity.  There  were  no  prob- 
lems during  the  burn,  after  which  Husband  maneuvered 
Columbia  into  a  right-side-up,  forward-facing  position,  with 
the  Orbiter's  nose  pitched  up. 

Entry  Interface,  arbitrarily  defined  as  the  point  at  which  the 
Orbiter  enters  the  discernible  atmosphere  at  400.000  feet, 
occurred  at  8:44:09  a.m.  (Entry  Interface  plus  000  seconds, 
written  EI-i-000)  over  the  Pacific  Ocean.  As  Columbia  de- 
scended from  space  into  the  atmosphere,  the  heat  produced 
by  air  molecules  colliding  with  the  Orbiter  typically  caused 
wing  leading-edge  temperatures  to  rise  steadily,  reaching 
an  estimated  2,500  degrees  Fahrenheit  during  the  next  six 
minutes.  As  superheated  air  molecules  discharged  light, 
astronauts  on  the  flight  deck  saw  bright  flashes  envelop  the 
Orbiter,  a  normal  phenomenon. 

At  8:48:39  a.m.  (EI4-270),  a  sensor  on  the  left  wing  leading 
edge  spar  showed  strains  higher  than  those  seen  i)n  previous 
Columbia  re-entries.  This  was  recorded  only  on  the  Modular 
Auxiliary  Data  System,  and  was  not  telemetered  to  ground 
controllers  or  displayed  to  the  crew  (see  Figure  2.6-1 ). 

At  8:49:32  a.m.  (EI-i-323).  traveling  at  approximately  Mach 
24.5,  Columbia  executed  a  roll  to  the  right,  beginning  a  pre- 
planned banking  turn  to  manage  lift,  and  therefore  limit  the 
Orbiter's  rate  of  descent  and  heating. 

At  8:50:53  a.m.  (El-i-404).  traveling  at  Mach  24.1  and  at 
approximately  243,000  feet,  Columbia  entered  a  10-minute 
period  of  peak  heating,  during  which  the  thermal  stresses 
were  at  their  maximum.  By  8:52:00  a.m.  (EI-i-471),  nearly 
eight  minutes  after  entering  the  atmosphere  and  some  300 
miles  west  of  the  California  coastline,  the  wing  leading-edge 
temperatures  usually  reached  2,650  degrees  Fahrenheit. 
Columbia  crossed  the  California  coast  west  of  Sacramento 
at  8:53:26  a.m.  (EI+557).  Traveling  at  Mach  23  and  23 1 .600 
feet,  the  Orbiter's  wing  leading  edge  typically  reached  more 
than  an  estimated  2.800  degrees  Fahrenheit. 
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Now  crossing  California,  the  Orbiter  appeared  to  obsei"v- 
ers  on  tiie  ground  as  a  brigiit  spot  of  light  moving  rapidly 
across  the  sky.  Signs  of  debris  being  shed  were  sighted  at 
8:53:46  a.m.  (EI+577),  when  the  superheated  air  surround- 
ing the  Orbiter  suddenly  brightened,  causing  a  noticeable 
streak  in  the  Orbiter's  luminescent  trail.  Observers  witnessed 
another  four  similar  events  during  the  following  23  seconds, 
and  a  bright  flash  just  seconds  after  Columbia  crossed  from 
California  into  Nevada  airspace  at  8:54:25  a.m.  (EI+614), 
when  the  Orbiter  was  traveling  at  Mach  22.5  and  227,400 
feet.  Witnesses  observed  another  1 8  similar  events  in  the  next 
four  minutes  as  Colunihia  streaked  over  Utah,  Arizona.  New 
Mexico,  and  Texas. 

In  Mission  Control,  re-entry  appeared  normal  until  8:54:24 
a.m.  (EI+613),  when  the  Maintenance,  Mechanical,  and  Crew 
Systems  (MMACS)  officer  informed  the  Flight  Director  that 
four  hydraulic  sensors  in  the  left  wing  were  indicating  "off- 
scale  low,"  a  reading  that  falls  below  the  minimum  capability 
of  the  sensor  As  the  seconds  passed,  the  Entry  Team  contin- 
ued to  discuss  the  four  failed  indicators. 

At  8:55:00  a.m.  ( El+65 1 ),  nearly  1 1  minutes  after  Coliiinhia 
had  re-entered  the  atmosphere,  wing  leading  edge  tempera- 
tures normally  reached  nearly  3.000  degrees  Fahrenheit.  At 
8:55:32  a.m.  (EI-(-683),  Columbia  crossed  from  Nevada  into 
Utah  while  traveling  at  Mach  21.8  and  223.400  ft.  Twenty 
seconds  later,  the  Orbiter  crossed  from  Utah  into  Arizona. 

At  8:56:30  a.m.  (EI+741 ).  Columbia  initiated  a  roll  reversal, 
turning  from  right  to  left  over  Arizona.  Traveling  at  Mach 
20.9  and  219.000  feet,  Columbia  crossed  the  Arizona-New 
Mexico  state  line  at  8:56:45  (Ei+756),  and  passed  just  north 
of  Albuquerque  at  8:57:24  (El+795). 

Around  8:58:00  a.m.  (El-i-831).  wing  leading  edge  tem- 
peratures typically  decreased  to  2.880  degrees  Fahrenheit. 
At  8:58:20  a.m.  (  E1-k85  1 ),  traveling  at  209,800  feet  and  Mach 
19.5,  Columbia  crossed  from  New  Mexico  into  Texas,  and 
about  this  time  shed  a  Thermal  Protection  System  tile,  which 
was  the  most  westerly  piece  of  debris  that  has  been  recovered. 


Searchers  found  the  tile  in  a  field  in  Littlefieid,  Texas,  just 
northwest  of  Lubbock.  At  8:59:15  a.m.  (EI-^906),  MMACS 
informed  the  Flight  Director  that  pressure  readings  had  been 
lost  on  both  left  main  landing  gear  tires.  The  Flight  Director 
then  told  the  Capsule  Communicator  (CAPCOM)  to  let  the 
crew  know  that  Mission  Control  saw  the  messages  and  was 
evaluating  the  indications,  and  added  that  the  Flight  Control 
Team  did  not  understand  the  crew's  last  transmission. 

At  8:59:32  a.m.  (EI-i-923),  a  broken  response  from  the 
mission  commander  was  recorded:  "Roger,  [cut  off  in  mid- 
word) ..."  It  was  the  last  communication  from  the  crew  and 
the  last  telemetry  signal  received  in  Mission  Control.  Videos 
made  by  observers  on  the  ground  at  9:00:18  a.m.  (EI-i-969) 
revealed  that  the  Orbiter  was  disintegrating. 

2.7    Events  Immediately  Following 
THE  Accident 

A  series  of  events  occurred  immediately  after  the  accident 
that  would  set  the  stage  for  the  subsequent  investigation. 

NASA  Emergency  Response 

Shortly  after  the  scheduled  landing  time  of  9:16  a.m.  EST, 
NASA  declared  a  "Shuttle  Contingency"  and  executed  the 
Contingency  Action  Plan  that  had  been  established  after 
the  Cli(illc'ni>er  accident.  As  part  of  that  plan,  NASA  Ad- 
ministrator Sean  O'Keefe  activated  the  international  Space 
Station  and  Space  Shuttle  Mishap  Interagency  Investigation 
Board  at  I0:.30  a.m.  and  named  Admiral  Harold  W.  Gehman 
Jr.,  U.S.  Navy,  retired,  as  its  chair. 

Senior  members  of  the  NASA  leadership  met  as  part  of  the 
Headquarters  Contingency  Action  Team  and  quickly  notified 
astronaut  families,  the  President,  and  members  of  Congress. 
President  Bush  telephoned  Israeli  Prime  Minster  Ariel  Sha- 
ron to  inform  him  of  the  loss  oi  Columbia  crew  member  llan 
Ramon,  Israel's  first  astronaut.  Several  hours  later.  President 
Bush  addressed  the  nation,  saying.  "The  Columbia  is  lost. 
There  are  no  survivors." 
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The  Orbiter  has  a  large  glowing  Field  surrounding  it  in  this  view 
taken  from  Mesquite,  Texas,  /oolc/ng  south. 


Taken  at  the  same  time  as  the  photo  at  left,  but  from  Hewitt,  Texas, 
looking  north. 


13:46:39  (El*270) 
Sensor  1 

(Front  Wing  Spar  al 

RCC  Panel  9) 

small  increase  in  strain 


13:52:17 

LMG  Brake  Line  temp  0  -  On 

Wtieelwell  Inboard  Sidewall 

(Small  Increase  in  temp  - 

"Bit  Flip  Up") 


13:53:11 

Hydraulic  System  1  LH 

lnt)oard  Eleven  Actr  Ret  LN 

temp  Otf-Scale  Low 


13:49:49  (EH340) 

Left  OMS  Pod 

Thermocouple 

Start  of  off-nominal 

temperature  trend 


13:51:14(61*4251 

Sensor  4 

(Wing  Spar  Panel  9  temp) 

Stan  of  off-nominal  trend 


13:48:59  (EH2901 
Sensor  2 

(Wing  LE  LWR 

Attacfi  Clevis  RCC10) 

off-nominal 

temperature  trend 


13:50:19  (EH-370) 
Sensor  3 

(Left  Wing  Lower 
Surface  Thermocouple) 

Begins  off-nominal 
temperature  Increase 


13:51:00  (EK411) 

LATD     =  38  8  deg  N 
LONG    =  135.5  degW 
ALTD     =  242.824  ft 
VREL     =16.420  2  mph 
HRATE  =  76  51  blu(sq,ft.- 
QBAR    =  21.79  psf 


13:50:00  (El*351) 


Lj6,TD 
LONG  = 
ALTD  = 
VREL  = 
HRATE = 
08AR    = 


38.3  deg  N 
140,5  deg  W 
246.445  ft 
16,631 .2  mph 
70.40  btu(sq.ft.-s) 
17  42  psf 


13:52:06  (EI-M77) 

LATD     =  39  0  deg  N 
LONG   =  130-1  deg  W 
ALTD     =237.910  ft 
VREL     =16, 133.3  mph 
HFiATE  =  80.73  btu(sq.fl  -s) 
OBAR    =26  2  psf 


13:53:06  (EK537) 

LATD     =  38  8  deg  N 
LOI>IG    =125  2  deg  W 
ALTD     =  233.426  ft 
VREL     =15,823.8  mph 
HRATE  =  83.98  blu(Sg  ft.-s) 
QBAR    =30.88  psf 


13:54:06  (EH-597) 

LATD     =  38.4  deg  N 
LONG    =  120.5  deg  W 
ALTD     =229.037  ft 
VREL     =15,470.0  mph 
HRATE  =  86.34  btu(sq.fl,-s) 
QBAR    =36  04  psf 


Figure  2.6-1 .  This  simpliFied  timeline  shows  the  re-entry  path  of  Columbia  on  February  1,  2003.  The  information  presented  here  is  a  com- 
posite of  sensor  data  telemetered  to  the  ground  combined  with  data  from  the  Modular  Auxiliary  Data  System  recorder  recovered  after  the 
accident.  Note  that  the  First  off-nominal  reading  was  a  small  increase  in  a  strain  gauge  at  the  front  wing  spar  behind  RCC  panel  9-left.  The 
chart  is  color-coded:  blue  boxes  confoin  position,  attitude,  and  velocity  information;  orange  boxes  indicate  when  debris  was  shed  from  the 
Orbiter;  green  boxes  are  signiFicant  aerodynamic  control  events;  gray  boxes  confain  sensor  information  from  the  Modular  Auxiliary  Data 
System,  and  yellow  boxes  contain  telemetered  sensor  information.  The  red  boxes  indicate  other  significant  events. 
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This  view  was  taken  from  Dallas.  (Robert  McCullough/©  2003  The 
Dallas  Morning  News) 


This  video  was  captured  by  a  Danish  crew  operating  an  AH-64 
Apache  helicopter  near  Fort  Hood,  Texas. 


STS-107  Re-entry  Trajectory  and  Timeline 
(First  Off-Nominal  Event  to  Loss  of  Signal) 


13:55:07-58:11 


D»bris#?-15 


13:57:24 

Main  Landing  Gear 

LH  Outboard  Tire 

Pressure  2  (Slart  of 

il  trend  - 

■Bit  Flip  Up") 


13:55:06  (El*657) 

LATD     =  37  8  deg  N 
LONG    =1l69degW 
ALTD     =  22S.079  K 
VREL     =  15,057,9  mpll 
HRATE  =  86,72  blu(sq,N  -s) 
QBAR    =  40,90  ps( 


13:56:06  (EH-717) 

lATD     =  36  7  deg  N 
LONG    =1117degW 
ALTD     =  221,649  « 
VREL     =  14.600,3  mph 
HRATE  =  85  10  btu(sq  tt  -s) 
QBAR    =45  05psf 


13:57:06  (El*777) 

LATD     =  35  7  deg  N 
LONG    =  107  6  deg  W 
ALTO     =218,783  ft 
VREL    =14,070  9  mph 
HRATE  =  81 ,00  biu(sq.fl,- 
QBAR    =  47.93  psf 


13:58:02  (EH-833) 

LATD     =  34,6  derj  N 
LONG    =  104  2  deg  W 
ALTO     =  212,475  ft 
VREL     =13,499,3  mph 
HRATE  =  81,59  btu(sq,ft,-s) 
QBAR    =58  29psf 


13:59:06  (El*897) 

LATD    =  33  4  deg  N 
LONG    =  100,4  deg  W 
ALTD     =  204.320  tt 
VREL    =  12,726,9  mph 
HRATE  =  80,44  btu(sq.fl  - 
QBAR    =73  30psf 


13:59:31 

(El'r922) 

LATD 

32  9  deg  N 

LONG 

-  99,8  deg  W 

ALTD 

200.861  ft 

VREL 

- 12,384  8  mph 

HRATE 

-  79,29  Wu(sq,ft,-S) 

QBAR 

=  80  19  psf 

Report    Voi 


COLUMBIA 

ACCIDENT  INVESTIGATION  BOARD 


Mission  Control  Center  Communications 


Al  8:49  a.m.  Eastern  Standard  lime  (Hl+289),  the  Orbiter's  flight 
control  system  began  steering  a  precise  course,  or  drag  profile, 
with  the  initial  roll  command  occurring  about  .^0  seconds  later.  At 
8:49:38  a.m.,  the  Mission  Control  Guidance  and  Procedures  offi- 
cer called  the  Flight  Director  and  indicated  that  the  ""closed-loop" 
guidance  system  had  been  initiated. 

The  Maintenance,  Mechanical,  (nid  Crew  Systems  (MMACS)  of- 
ficer and  the  Flif^ht  Director  f  Flight )  had  the  followlnii  exchaiific 
beginning  at  8:54:24  a.m.  (El +6 1 J  I. 

MMACS:     -Flight -MMACS." 

Flight:  -Go  ahead,  MMACS." 

MMACS:     "'FYI.  I've  just  lost  four  separate  temperature 

transducers  on  the  left  side  of  the  vehicle,  hydraulic 
return  temperatures.  Two  of  them  on  system  one  and 
one  in  each  of  systems  tv\o  and  three." 

Flight:  "Four  hyd  |hydraulic|  return  temps?" 

MMACS:    "To  the  left  outboard  and  left  inboard  elevon." 

Flight:  "Okay,  is  there  anything  common  to  them?  DSC 

idiscrete  signal  conditioner!  "^^r  MDM  |  multiplexer- 
demultiplexer]  or  anything?  I  mean,  you're  telling 
me  you  lost  them  all  at  exactly  the  same  time?" 

MMACS:     "No.  not  exactly,  fhey  were  w  ithin  probably  four  or 
five  seconds  of  each  other." 

Flight:  ""Okay,  where  are  those,  where  is  that  instrumenta- 

tion located?" 

MMACS:     ""All  four  of  them  are  located  in  the  aft  jjart  of  the 

left  wing,  right  in  front  of  the  elevons.  elevon  actua- 
tors. And  there  is  no  commonality." 

Flight:  ""No  commonality." 

At  H:56:02  a.m.  (El+713).  the  conversation  between  the  Flight 
Director  and  the  MMACS  officer  continnes: 


The  Flight  Director  then  continues  to  dLsctiss  indications  with  other 
Mission  Control  Center  personnel.  Induduig  the  Guidance,  Navi- 
gation, and  Control  officer  (GNC). 


Flight: 
MMACS: 


Flisiht: 


"MMACS,  tell  me  again  which  systems  they're  for." 
'That's  all  three  hydraulic  systems.  It's  ...  two  of 
them  are  to  the  left  outboard  elevon  and  two  of  them 
to  the  left  inboard." 
"Okay,  I  got  )ou." 


Flight: 
GNC: 
Flight: 

GNC: 


Flight: 

MMACS: 

Flight: 

MMACS: 

Flight: 

MMACS: 

Flight: 


MMACS: 


Flis-hl: 


""GNC -Flight." 

'"Flight -GNC." 

""F>erythitig  look  good  to  you,  control  and  rates  and 

e\erything  is  nominal,  right?" 

"Control's  been  stable  through  the  rolls  that  we've 

done  so  far,  flight.  We  have  good  trims.  I  don't  see 

anything  (Hit  of  the  ordinary." 

"Okay.  And  MMACS,  Flight?" 

"Flight  -  MMACS." 

""All  other  indications  for  your  hydraulic  system 

indications  are  good." 

■"They're  all  good.  We've  had  good  quantities  all  the 

way  across." 

""And  the  other  temps  are  normal?" 

"'The  other  lemps  are  normal,  yes  sir." 

""And  v\  hen  you  say  you  lost  these,  are  you  saying 

that  they  went  to  zero?"  [Time:  8:57:59  a.m.,  EI-^830i 

""Or,  off-scale  low?" 

"All  four  of  them  are  off-scale  low.  And  they  were 

all  staggered.  They  were,  like  I  said,  within  several 

seconds  of  each  other." 

"Okay." 


At  (S';.5,S'.-CW  a.m.  (FI-i-iS.< 1 1.  Columbia  crossed  the  New  Me.xlco- 
Te.ms  state  line.  Within  the  ininiile.  a  broken  call  came  on  the 
air-to-ground  voice  loop  from  Columbia  !v  commander.  "And.  uh, 
Hon ..."  This  was  followed  by  a  call  from  MMAC  S  about  failed  tire 
pressure  sensors  at  8:59:15  a.m.  (EI+906). 

MMACS:     "Flight -MMACS." 
Flight:  ""Go." 

MMACS:     ""We  just  lost  tire  pressure  on  the  left  outboard  and  left 
inboard,  both  tires." 
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The  Flight  Director  then  told  the  Capsule  Coinniiiiiicator  (CAP- 
COM)  to  let  the  crew  know  that  Mission  Control  saw  the  messai;es 
and  that  the  Flii^ht  Control  Team  was  evaliiatini^  the  indications 
and  did  not  copy  their  last  transmission. 

CAPCOM:  "And  Columbia.  Houston,  we  see  your  tire  pressure 

messages  and  we  did  not  copy  your  last  call." 
Flight:  "Is  it  instrumentation,  MMACS?  Gotta  be  ..."" 

MMACS:     "Flight  -  MMACS,  those  are  also  oft-scale  low." 

At  8:59:32  a.m.  (EI+92J),  Columbia  was  approachinii  Dallas. 
Te.xas.  at  200.700  feet  and  Macli  18.1.  At  the  same  time,  another 
broken  call,  the  final  call  from  Columbia',?  commander,  came  on 
the  air-to-ground  voice  loop: 

Commander;  "Roger,  |cut  off  in  mid-\\ord|  ..." 

This  call  may  have  been  about  the  backup  fHf-ht  system  tire  pres- 
sure fault-summary  mes.tafies  annunciated  to  the  crew  onboard. 
and  .'ieen  in  the  telemetry  by  Mission  Control  personiwl.  An  ex- 
tended loss  of  signal  began  at  08:59:32.136  a.m.  (EI+9231.  This 
was  the  last  valid  data  accepted  by  the  Mission  Control  computer 
stream,  and  no  further  real-time  data  updates  occurred  in  Mis- 
sion Control.  This  coincided  with  the  appro.ximate  time  when  the 
Flight  Control  Team  would  e.xpect  a  short-duration  loss  of  signal 
during  antenna  switching,  as  the  onboard  communicatiim  system 
automatically  reconfigured  from  the  west  Tracking  atul  Data 
Relay  System  satellite  to  either  the  east  satellite  or  to  the  ground 
station  at  Kennedy  Space  Center  The  following  exchange  then 
took  place  on  the  Flight  Director  loop  with  the  Instrumentation 
and  Communication  Office  {INCO): 

INCO:  "Flight -INCO." 

Flight:         "Go." 

INCO:  "Just  taking  a  few  hits  here.  We're  right  up  on  top  of 

the  tail.  Not  too  bad." 

The  Flight  Director  then  resumes  discussion  with  the  MMACS 
officer  at  9:00:18  a.m.  (£1+969). 


Flight: 

MMACS: 

Flight: 


MMACS: 


Flight: 
MMACS: 


"MMACS  -  Flight." 
"Flight -MMACS." 

"And  there's  no  commonality  between  all  these  tire 
pressure  instrumentations  and  the  hydraulic  return 
instmmentations." 

"No  sir,  there's  not.  We"\e  also  lost  the  nose  gear 
down  talkback  and  the  right  main  gear  down  talk- 
back." 

"Nose  gear  and  right  main  gear  down  talkbacks'.'" 
"Yes  sir." 


At  9:00:18  a.m.  (El +969).  the  postflight  video  and  imagery  anal- 
yses indicate  that  a  catastrophic  event  occurred.  Bright  flashes 
suddenly  enveloped  the  Orhiter.  followed  by  a  dramatic  change  in 
the  trail  of  superheated  air  This  is  considered  the  most  likely  lime 
of  the  main  breakup  <■>/' Columbia.  Because  the  loss  of  signal  had 
occurred  46  seconds  earlier  Mission  Control  had  no  insight  into 
this  event.  Mission  Control  continued  to  work  the  loss-of- signal 
problem  to  regain  conmumication  with  Columbia.' 

INCO:  "Flight  -  INCO.  I  didn't  expect,  uh,  this  bad  of  a  hit 

on  comm  |communications|." 
Flight:  "GC  j Ground  Control  officer]  how  far  are  we  from 

IIHF'.'  Is  that  two-minute  clock  good?" 
GC:  "Afhrmative,  Flight." 

GNC:  "Flight -GNC." 

Flight:  "Go." 


GNC: 


Flisjht: 


"if  we  have  any  rea.son  to  suspect  any  sort  o 
controllability  issue,  I  would  keep  the  control  cards 
handy  on  page  4-dash-l.^." 
"Copy." 


At  9:02:21  a.m.  (EI+1092,  or  18  minutes-plus),  the  Mission 
Control  Center  commentator  reported,  "Fourteen  minutes  to 
touchdown  for  Columbia  at  the  Kennedy  Space  Center.  Flight 
controllers  are  continuing  to  stand  by  to  regain  communications 
with  the  spacecraft. " 

Flight:  "INCO,  we  were  rolled  left  last  data  we  had  and  you 

were  expecting  a  little  bit  of  ratty  comm  jcommuni- 

cations|,  but  not  this  long?" 
INCO:  "That's  correct.  Flight.  1  expected  it  to  be  a  little 

intermittent.  And  this  is  pretty  solid  right  here." 
Flight:  "No  onboard  system  config  [configuration]  changes 

right  before  we  lost  data?" 
INCO:  "That  is  correct.  Flight.  All  looked  good." 

Flight:  "Still  on  string  two  and  everything  looked  good?" 

INCO:  "String  two  looking  good." 

The  Ground  Control  officer  then  told  the  Flight  Director  that 
the  Orbiter  was  within  two  rniiuites  of  acquiring  the  Kennedy 
Space  Center  ground  .station  for  communications,  "Two  minutes 
to  MILA.  "  The  Flight  Director  told  the  CAPCOM  to  fry  another 
communications  check  with  Columbia,  including  one  on  the  UHF 
system  (via  MILA,  the  Kennedy  Space  Center  tracking  station): 

CAPCOM:  "Columbia.  Houston,  comm  Icuniniunications] 

check." 
CAPCOM:  "Columbia.  Houston,  IIHF  comm  ]communicalions] 

check." 

At  9:03:45  a.m.  (El+1176,  or  19  minutes-plus),  the  Mission  Con- 
trol Center  conunentator  reported,  "CAPCOM  Charlie  Hobaugh 
calling  ColiHiibia  on  a  UHF  frequency  as  it  approaches  the  Mer- 
ritt  Island  (MILA)  tracking  station  in  Florida.  Twelve-and-a-half 
minutes  to  touchdown,  accinxling  to  clocks  in  Mission  Control." 


MMACS: 

Flight: 

MMACS: 


Flight: 


"Flight -MMACS." 

"MMACS'.'" 

"On  the  tire  pressures,  we  did  see  them  go  erratic  for 

a  little  bit  before  they  went  away,  so  I  do  believe  it's 

instrumentation." 

"Okay." 


The  Flight  dmtrol  Team  still  luul  no  indications  of  any  serious 
problems  onboard  the  Orbiter  In  Mission  Control,  there  was  no 
way  to  know  the  exact  cause  of  the  fidled  sensor  measurements, 
and  while  there  was  concern  for  the  e.xtended  loss  of  signal,  the 
recourse  was  to  continue  to  try  to  regain  communications  and  in 
the  meantime  determine  if  the  other  .systems,  based  on  the  last 
valid  data,  continued  to  appear  as  expected.  The  Flight  Director 
told  the  CAPCOM  to  continue  to  try  to  raise  Columbia  via  UHF: 

CAPCOM:  "Columbia.  Houston,  UHF  comm  Icomnuinications] 

check." 
CAPCOM:  "Columbia.  Houston,  UHF  comm  Icommunications) 

check." 
GC:  "Flight -GC." 

Flight:  "Go." 

GC:  "MILA  not  reporting  any  RF  (radio  frequency]  at 

this  time." 


[continued  on  next  page/ 
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INCO: 


Hight: 
Flishl: 


FDO; 
GC: 
Flight: 
CAPCOM 

INCO: 
Flight: 
INCO: 
Flight: 
INCO: 


"Flight  -  INCO,  SPC  [stored  program  command] 

just  should  have  taken  us  to  S TDN  low."  [STDN  is 

the  Space  Trackin,!'  and  Data  Network,  or  i^roiiiid 

station  comwnnication  mode  I 

"Okay." 

"FDO.  when  are  you  expecting  tracking?  "  [FDO 

is  the  Flii^ht  Dynamics  Officer  in  the  Mission 

Control  Center/ 

"One  minute  ago.  Flight." 

"And  Flight  -  (iC,  no  C-band  yet." 

"Copy." 

"Colinnhia.  Houston,  UHFcomm  (communica- 

lionsl  check." 

"Flight -INCO." 

"Gor 

"I  could  swap  strings  in  the  blind." 

"Okay,  command  us  over."  !^^ 

"In  work.  Flight." 


At  0Q:08:25  a.m.  (EI+ 1456.  or  24  miiuites-pltiM  ilie  Instrumen- 
tation and  Coininnnications  Officer  reported.  "l-'lii>ht  -  INCO. 
I've  commanded  string  one  in  the  blind.  "  which  indicated  that 
the  officer  had  executed  a  coninnnid  sei/iience  lo  Columbia  tf> 
force  the  onhc/ard  S-inind  coninunucaiion\  sxsiciu  to  the  backup 
strinfi  of  avionics  to  try  to  retrain  conininnication.  per  the  Fli,i;lil 
Director 's  direction  in  the  previous  call. 

GC:  "And  Flight -GC." 

Flight:         "Go." 

GC:  "IVllLA's  taking  one  of  their  antennas  off  into  a 

search  mode  [to  try  to  lind  Columbia]." 

Flight:  "Copy.  FDO  -  Flight?" 

FDO:  "Go  ahead.  Flight." 

Flight:  "Did  we  get,  ha\c  \\c  gotten  any  tracking  data?" 

FDO:  "We  got  a  blip  nf  iiackmg  data,  il  was  a  ixul  data 

point.  Flight.  We  do  not  belies e  that  was  the 
Orbiter  j referring  to  an  errant  blip  on  the  larife 
front  screen  in  the  Mission  Control,  where  Orhiter 
'     tracking  data  is  displnycd./  We're  entering  a 
search  pattern  v\  itli  our  C  bands  at  this  time.  We 
do  not  have  any  valid  data  at  this  time." 

By  this  time.  9:(W:29  a.m.  (F/+I520).  Coliimbia'.f  .speed  would 
have  dropped  lo  Mach  2.5  for  a  standard  approach  to  the  Ken- 
nedy .Space  Center 


Flight: 
FDO: 


"OK.  Any  other  trackers  that  we  can  go  to?" 
"Let  me  start  talking.  Flight,  to  my  navigator." 


At  9:12:39  a.tn.  (E+ 1710.  or  2H  minutes-plus  I.  Col  umbia  should 
have  been  hanking  on  the  heading  aligmnent  cone  to  line  up  on 
Runway  33.  At  about  this  time,  a  nwmher  of  the  Mission  Con- 
trol team  received  a  call  on  his  cell  phone  from  someone  who 
had  just  seen  live  television  coverage  «/ Columbia  breaking 
up  during  re-entry.  The  Mission  Control  team  member  walked 
to  the  Flight  Director's  console  and  told  him  the  Orhiter  had 
disintegrated. 


Flight: 

GC: 

Flight: 


"GC,  -  Flight.  GC 
"Flight -GC." 
"Lock  the  doors." 


Flight? 


Having  confirmed  the  loss  f.;/' Columbia,  the  Entry  Flight  Di- 
rector directed  the  Flight  Control  Team  to  begin  contingency 
procedures. 


In  order  to  preserve  all  material  relating  to  STS-107  as 
evidence  for  the  accident  investigation,  NASA  officials  im- 
pounded data,  software,  hardware,  and  facilities  at  NASA 
and  contractor  sites  in  accordance  with  the  pre-existing 
mishap  response  plan. 

At  the  .Johnson  Space  Center,  the  door  to  Mission  Control 
was  locked  while  personnel  at  the  flight  control  consoles 
archived  all  original  mission  data.  At  the  Kennedy  Space 
Center,  mission  facilities  and  related  hardware,  including 
Lainich  Complex  39-A,  were  put  under  guard  or  stored  in 
secure  warehouses.  Officials  took  similar  actions  at  other 
key  Shuttle  facilities,  including  the  Marshall  Space  Flight 
Center  and  the  Michoud  Assembly  Facility. 

Within  minutes  of  the  accident,  the  NASA  Mishap  Inves- 
tigation Team  was  activated  to  coordinate  debris  recovery 
effoils  with  local,  state,  and  federal  agencies.  The  team  ini- 
tially operated  out  of  Barksdale  Air  Force  Base  in  Louisiana 
and  .soon  after  in  Lutl<in,  Texas,  and  Carswell  Field  in  Fort 
Worth,  Texas. 

Debris  Search  and  Recovery 

On  the  morning  of  February  I,  a  crackling  boom  that  sig- 
naled the  breakup  of  Coltiiiihkt  startled  residents  of  East 
Texas.  The  long,  low-pitched  rumble  heard  just  before 
8:00  a.m.  Central  Standard  Time  (CST)  was  generated  by 
pieces  of  debris  streaking  into  the  upper  atmosphere  at 
nearly  12,000  miles  per  hour.  Within  minutes,  that  debris 
fell  to  the  ground.  Cattle  stampeded  in  Eastern  Nacogdo- 
ches County.  A  fisherman  on  Toledo  Bend  reservoir  saw 
a  piece  splash  down  in  the  water,  while  a  women  driving 
near  Lufkin  almost  lost  control  of  her  car  when  debris 
smacked  her  windshield.  As  91 1  dispatchers  across  Texas 
were  flooded  with  calls  repoiling  sonic  booms  and  smoking 
debris,  emergency  personnel  soon  realized  that  residents 
were  encountering  the  remnants  of  the  Orbiter  that  NASA 
had  reported  missing  minutes  before. 

The  emergency  response  that  began  shortly  after  8:00  a.m. 
CST  Saturday  moniing  grew  into  a  massive  effort  to  decon- 
taminate and  recover  debris  strewn  over  an  area  that  in  Texas 
alone  exceeded  2,000  square  miles  (see  Figure  2.7- 1 ).  Local 
fire  and  police  departments  called  in  all  personnel,  who  be- 
gan responding  to  debris  repoils  that  by  late  afternoon  were 
phoned  in  at  a  rate  of  18  per  minute. 

Within  hours  of  the  accident.  President  Bush  declared 
Ea.st  Texas  a  federal  disaster  area,  enabling  the  dispatch 
of  emergency  response  teams  from  the  Federal  Emer- 
gency Management  Agency  and  Environmental  Protection 
Agency.  As  the  day  wore  on,  county  constables,  volunteers 
on  horseback,  and  local  citizens  headed  into  pine  forests 
and  bushy  thickets  in  search  of  debris  and  crew  remains, 
while  National  Guard  units  mobilized  to  assist  local  law- 
enforcement  guard  debris  sites.  Researchers  from  Stephen 
F.  Austin  University  sent  seven  teams  into  the  field  with 
Global  Positioning  System  units  to  mark  the  exact  location 
of  debris.  The  researchers  and  later  searchers  then  used  this 
data  to  update  debris  distribution  on  detailed  Geographic 
Information  System  maps. 
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Figure  2.7-1 .  The  debris  field  in  East  Texas  spread  over  2,000  square  miles,  and  eventually  over  700,000  acres  were  searched. 


Public  Safety  Concerns 

From  the  start.  NASA  officials  sought  to  make  the  public 
aware  of  the  hazards  posed  by  certain  pieces  of  debris, 
as  well  as  the  importance  of  turning  over  all  debris  to  the 
authorities.  Coliiwhia  carried  highly  toxic  propellants  that 
maneuvered  the  Orbiter  in  space  and  during  early  stages 
of  re-entry.  These  propellants  and  other  gases  and  liquids 
were  stored  in  pressurized  tanks  and  cylinders  that  posed  a 
danger  to  people  who  might  approach  Orbiter  debris.  The 
propellants,  monomethyl  hydrazine  and  nitrogen  tetroxide. 
as  well  as  concentrated  ammonia  used  in  the  Orbiter's  cool- 
ing systems,  can  severely  burn  the  lungs  and  exposed  skin 
when  encountered  in  vapor  form.  Other  materials  used  in  the 
Orbiter.  such  as  beryllium,  are  also  toxic.  The  Orbiter  also 
contains  various  pyrotechnic  devices  that  eject  or  release 
items  such  as  the  Ku-Band  antenna,  landing  gear  doors,  and 
hatches  in  an  emergency.  These  pyrotechnic  devices  and 
their  triggers,  which  are  designed  to  withstand  high  heat 
and  therefore  may  have  survived  re-entry,  posed  a  danger  to 
people  and  livestock.  They  had  to  be  removed  by  personnel 
trained  in  ordnance  disposal. 

In  light  of  these  and  other  hazards,  NASA  officials  worked 
with  local  media  and  law  enforcement  to  ensure  that  no  one 
on  the  ground  would  be  injured.  To  determine  that  Orbiter 
debris  did  not  threaten  air  quality  or  drinking  water,  the  Envi- 


ronmental Protection  Agency  activated  Emergency  Response 
and  Removal  Service  contractors,  who  surveyed  the  area. 

Land  Search 

The  tremendous  efforts  mounted  by  the  National  Guard, 
Texas  Department  of  Public  Safety,  and  emergency  per- 
sonnel from  local  towns  and  communities  were  soon  over- 
whelmed by  the  expanding  bounds  of  the  debris  field,  the 
densest  region  of  which  ran  from  just  south  of  Fort  Worth. 
Texas,  to  Fort  Polk,  Louisiana.  Faced  with  a  debris  field 
.several  orders  of  magnitude  larger  than  any  previous  ac- 
cident site,  NASA  and  Federal  Emergency  Management 
Agency  officials  activated  Forest  Service  wildland  firefight- 
ers to  serve  as  the  primary  search  teams.  As  NASA  identi- 
fied the  areas  to  be  searched,  personnel  and  equipment  were 
furnished  by  the  Forest  Service. 

Within  two  weeks,  the  number  of  ground  searchers  ex- 
ceeded 3,000.  Within  a  month,  more  than  4.000  searchers 
were  flown  in  from  around  the  country  to  base  camps  in 
Corsicana.  Palestine.  Nacogdoches,  and  Hemphill.  Texas. 
These  searchers,  drawn  from  across  the  United  States  and 
Puerto  Rico,  worked  1 2  hours  per  day  on  1 4-,  2 1  -,  or  30-day 
rotations  and  were  accompanied  by  Global  Positioning  Sys- 
tem-equipped NASA  and  Environmental  Protection  Agency 
personnel  trained  to  handle  and  identify  debris. 
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Based  on  sophisticated  mapping  of  debris  trajectories  galii- 
ered  from  telemetry,  radar,  photographs,  video,  and  meteoro- 
logical data,  as  well  as  reports  from  the  general  public,  teams 
were  dispatched  to  walk  precise  grids  of  East  Texas  pine 
brush  and  thicket  (see  Figure  2.7-2).  In  lines  10  feet  apart,  a 
distance  calculated  to  provide  a  75  percent  probability  of  de- 
tecting a  si.x-inch-square  object,  wildland  firefighters  scoured 
snake-infested  swamps,  mud-filled  creek  beds,  and  brush  so 
thick  that  one  team  advanced  only  a  few  hundred  feet  in  an 
entire  morning.  These  20-person  ground  teams  systemati- 
cally covered  an  area  two  miles  to  either  side  of  the  Orbiter's 
ground  track.  Initial  efforts  concentrated  on  the  search  for 
human  remains  and  the  debris  corridor  between  Corsicana, 
Texas,  and  Foil  Polk.  Searchers  gave  highest  priority  to  a  list 
of  some  20  "hot  items"  that  potentially  contained  crucial  in- 
formation, including  the  Orbiter's  General  Purpose  Comput- 
ers, film,  cameras,  and  the  Modular  Auxiliary  Data  System 
recorder.  Once  the  wildland  firefighters  entered  the  field, 
recovery  rates  exceeded  1 ,000  pieces  of  debris  per  day. 


Figure  2.7-2.  Searching  for  debris  was  o  laborious  task  thai  used 
thousands  of  people  walking  over  hundreds  of  acres  of  Texas  and 
Louisiana. 


After  searchers  spotted  a  piece  of  debris  and  determined  it 
was  not  hazardous,  its  location  was  recorded  with  a  Global 
Positioning  System  unit  and  photographed.  The  debris  was 
then  tagged  and  taken  to  one  of  foin-  collection  centers  at 
Corsicana,  Palestine,  Nacogdoches,  and  Hemphill,  Texas. 
There,  engineers  made  a  preliminary  identification,  entered 
the  find  into  a  database,  and  then  shipped  the  debris  to  Ken- 
nedy Space  Center,  where  it  was  further  analyzed  in  a  han- 
gar dedicated  to  the  debris  reconstruction. 

Air  Search 

Air  crews  used  37  helicopters  and  seven  fixed-wing  aircraft 
to  augment  ground  searchers  by  searching  for  debris  farther 
out  from  the  Orbiter's  ground  track,  from  two  miles  from  the 
centerline  to  five  miles  on  either  side.  Initially,  these  crews 
used  advanced  remote  sensing  technologies,  including  two 
satellite  platforms,  hyper-spectral  and  forward-looking  in- 
frared scanners,  forest  penetration  radars,  and  imagery  from 
Lockheed  U-2  reconnaissance  aircraft.  Becau.se  of  the  densi- 


Figure  2.7-3.  Tragically,  a  helicopter  crash  during  the  debris 
search  claimed  the  lives  of  Jules  "Buzz"  Mier  (in  black  coat)  and 
Charles  Krenek  (yellow  coat). 


ty  of  the  East  Texas  vegetation,  the  small  sizes  of  the  debris, 
and  the  inability  of  sensors  to  differentiate  Orbiter  material 
from  other  objects,  these  devices  proved  of  little  value.  As 
a  result,  the  detection  work  fell  to  spotter  teams  who  visu- 
ally scanned  the  terrain.  Air  search  coordinators  apportioned 
grids  to  allow  a  50  percent  probability  of  detection  for  a  one- 
foot-square  object.  Civil  Air  Patrol  volunteers  and  others  in 
powered  parachutes,  a  type  of  ultralight  aircraft,  also  partici- 
pated in  the  search,  but  were  less  successful  than  helicopter 
and  fixed-wing  aircrews  in  retrieving  debris.  During  the  air 
search,  a  Bell  407  helicopter  crashed  in  Angelina  National 
Forest  in  San  Augustine  County  after  a  mechanical  failure. 
The  accident  took  the  lives  of  Jules  F.  "Buzz"  Mier  Jr.,  a 
contract  pilot,  and  Charles  Krenek,  a  Texas  Forest  Service 
employee,  and  injured  three  others  (see  Figure  2.7-3). 

Water  Search 

The  United  States  Navy  Supervisor  of  Salvage  organized 
eight  dive  teams  to  search  Lake  Nacogdoches  and  Toledo 
Bend  Reservoir,  two  bodies  of  water  in  dense  debris  fields. 
Sonar  mapping  of  more  than  3 1  square  miles  of  lake  bottom 
identified  more  than  3,100  targets  in  Toledo  Bend  and  326 
targets  in  Lake  Nacogdoches.  Divers  explored  each  target, 
but  in  murky  water  with  visibility  of  only  a  few  inches, 
underwater  forests,  and  other  submerged  hazards,  they  re- 
covered only  one  object  in  Toledo  Bend  and  none  in  Lake 
Nacogdoches.  The  60  divers  came  from  the  Navy.  Coast 
Guard.  Environmental  Protection  Agency.  Texas  Forest 
Service.  Texas  Department  of  Public  Safety.  Houston  and 
Galveston  police  and  fire  departments,  and  Jasper  County 
Sheriff's  Department. 

Search  Beyond  Texas  and  Louisiana 

As  thousands  of  personnel  combed  the  Orbiter's  ground  track 
in  Texas  and  Louisiana,  other  civic  and  community  groups 
searched  areas  farther  west.  Environmental  organizations 
and  local  law  enforcement  walked  three  counties  of  Cali- 
fornia coastline  where  oceanographic  data  indicated  a  high 
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probability  of  debris  washing  ashore.  Prison  inmates  scoured 
sections  of  the  Nevada  desert.  Civil  Air  Patrol  units  and  other 
volunteers  searched  thousands  of  acres  in  New  Mexico,  by 
air  and  on  foot.  Though  these  searchers  failed  to  find  any 
debris,  they  provided  a  valuable  service  by  closing  out  poten- 
tial debris  sites,  including  nine  areas  in  Texas,  New  Mexico. 
Nevada,  and  Utah  identified  by  the  National  Transportation 
Safety  Board  as  likel>  to  contain  debris.  NASA's  Mishap  in- 
vestigation Team  addressed  each  of  the  1 ,4?9  debris  reports 
it  received.  So  eager  was  the  general  public  to  turn  in  pieces 
of  potential  debris  that  NASA  received  reports  from  37  U.S. 
states  that  Columbia's  re-entiy  ground  track  did  not  cross,  as 
well  as  from  Canada,  Jamaica,  and  the  Bahamas. 

Property  Damage 

No  one  was  injured  and  little  property  damage  resulted  from 
the  tens  of  thousands  of  pieces  of  falling  debris  (see  Chap- 
ter 10).  A  reimbursement  program  administered  by  NASA 
distributed  approximately  $5(),00()  to  property  owners  who 
made  claims  resulting  from  falling  debris  or  collateral  dam- 
age from  the  search  efforts.  There  were,  however,  a  few  close 
calls  that  emphasize  the  importance  of  selecting  the  ground 
track  that  re-enlering  Orbiters  follow.  A  600-pound  piece  of 
a  main  engine  dug  a  six-foot-wide  hole  in  the  Fort  Polk  golf 
course,  while  an  800-pound  main  engine  piece,  which  hit  the 
ground  at  an  estimated  1 ,400  miles  per  hour,  dug  an  even 
larger  hole  nearby.  Disaster  was  narrowly  averted  outside 
Nacogdoches  when  a  piece  of  debris  landed  between  two 
highly  explosive  natural  gas  tanks  set  just  feet  apart. 

Debris  Amnesty 

The  response  of  the  public  in  reporting  and  turning  in  debris 
was  outstanding.  To  reinforce  the  message  that  Orbiter  de- 
bris was  government  property  as  well  as  essential  evitlence 
of  the  accident's  cause,  NASA  and  local  media  officials 
repeatedly  urged  local  residents  to  report  all  debris  imme- 
diately. For  those  who  might  have  been  keeping  debris  as 
souvenirs.  NASA  offered  an  amnesty  that  ran  for  several 
days.  In  the  end,  only  a  handful  of  people  were  prosecuted 
for  theft  of  debris. 

Final  Totals 

More  than  25,000  people  from  270  organizations  t(x)k  part 
in  debris  recovery  operations.  All  told,  searchers  expended 
over  1.5  million  hours  covering  more  than  2.3  million  acres, 
an  area  approaching  the  size  of  Connecticut.  Over  700,000 
acres  were  searched  by  foot,  and  searchers  found  over  X4,000 
individual  pieces  of  Orbiter  debris  weighing  more  than 
84,900  pounds,  representing  38  percent  of  the  Orbiter's  dry 
weight.  Though  significant  evidence  from  radar  returns  and 
video  recordings  indicate  debris  shedding  across  California, 
Nevada,  and  New  Mexico,  the  most  westerly  piece  of  con- 
firmed debris  (at  the  time  this  report  was  published)  was  the 
tile  found  in  a  field  in  Littleton,  Texas.  Heavier  objects  with 
higher  ballistic  coefficients,  a  measure  of  how  far  objects  will 
travel  in  the  air,  landed  toward  the  end  of  the  debris  trail  in 
western  Louisiana.  The  most  easterly  debris  pieces,  includ- 
ing the  Space  Shuttle  Main  Engine  turbopumps,  were  found 
in  Fort  Polk,  Louisiana. 


Figure  2.7-4.  Recovered  debris  was  returned  fo  the  Kennedy 
Space  Center  where  if  wos  laid  out  in  a  large  hangar.  The  tape 
on  the  floor  helped  workers  place  each  piece  near  where  it  had 
been  on  the  Orbiter. 


The  Federal  Emergency  Management  Agency,  which  di- 
rected the  overall  effort,  expended  more  than  $305  million 
to  fund  the  search.  This  cost  does  not  include  what  NASA 
spent  on  aircraft  support  or  the  wages  of  hundreds  of  civil 
servants  employed  at  the  recovery  area  and  in  analysis  roles 
at  NASA  centers. 

The  Importance  of  Debris 

The  debris  collected  (see  Figure  2.7-4)  by  searchers  aided 
the  investigation  in  significant  ways.  Among  the  most 
important  finds  was  the  Modular  Auxiliary  Data  System 
recorder  that  captured  data  from  hundreds  of  sensors  that 
was  not  telemetered  to  Mission  Control.  Data  from  these 
800  sensors,  recorded  on  9,400  feet  of  magnetic  tape,  pro- 
vided investigators  with  millions  of  data  points,  including 
temperature  sensor  readings  from  Coliiiiihia's  left  wing 
leading  edge.  The  data  al.so  helped  fill  a  30-.second  gap  in 
telemetered  data  and  provided  an  additional  14  seconds  of 
data  after  the  telemetry  loss  of  signal. 

Recovered  debris  allowed  investigators  to  build  a  three-di- 
mensional reconstruction  of  Cohtmhia'?,  left  wing  leading 
edge,  which  was  the  basis  for  understanding  the  order  in 
which  the  left  wing  structure  came  apart,  and  led  investiga- 
tors to  determine  that  heat  first  entered  the  wing  in  the  loca- 
tion where  photo  analysis  indicated  the  foam  had  struck. 
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Endnotes  for  Chapter  2 


The  citations  that  contain  a  reference  to  "CAIB  document"  with  CAB  or 
CTF  followed  by  seven  to  eleven  digits,  such  as  CABOOl-0010,  refer  to  a 
document  in  the  Columbia  Accident  Investigation  Board  database  maintained 
by  the  Department  of  Justice  and  archived  at  the  National  Archives. 


The  primary  source  document  for  this  process  is  NSTS  08117, 
Requirements  and  Procedures  for  Certification  and  Flight  Readiness. 
CAIB  document  CTF017-03960413. 

Statement  of  Daniel  S.  Goldin,  Administrator,  National  Aeronautics  and 
Space  Administration,  before  the  Subcommittee  on  VA-HUD-lndependent 
Agencies,  Committee  on  Appropriations,  House  of  Representatives, 
March  31,  1998.  CAIB  document  CAB048-04000418 

Roberta  L.  Gross,  Inspector  General,  NASA,  to  Daniel  S.  Goldin, 
Administrator,  NASA,  "Assessment  of  the  Triana  Mission,  G-99013,  Final 
Report,"  September  10,  1999.  See  in  particular  footnote  3,  concerning 
Triana  and  the  requirements  of  the  Commercial  Space  Act,  and  Appendix 
C,  "Accounting  for  Shuttle  Costs."  CAIB  document  CAB048-02680269 


Although  there  is  more  volume  of  liquid  hydrogen  in  the  External  Tank, 
liquid  fiydrogen  is  very  light  and  its  slosh  effects  are  minimal  and  are 
generally  ignored.  At  launch,  the  External  Tank  contains  approximotely 
1 .4  million  pounds  (140,000  gallons)  of  liquid  oxygen,  but  only  230,000 
pounds  (385,000  gallons)  of  liquid  hydrogen. 

The  Performance  Enhancements  (PE)  flight  profile  flown  by  STS107  is 
a  combination  of  flight  software  and  trajectory  design  changes  that 
were  introduced  in  late  1997  for  STS-85.  These  changes  to  the  ascent 
flight  profile  allow  the  Shuttle  to  carry  some  1,600  pounds  of  additional 
poylood  on  International  Space  Station  assembly  missions.  Although 
developed  to  meet  the  Space  Station  poylood  lift  requirement,  a  modified 
PE  profile  has  been  used  for  all  Shuttle  missions  since  it  was  introduced. 
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One  of  the  central  puqjoses  of  this  investigation,  like  those 
for  other  kinds  of  accidents,  was  to  identify  the  chain  of 
circumstances  that  caused  the  Coliiinhia  accident,  [n  this 
case  the  task  was  particularly  challenging,  because  the 
breakup  of  the  Orbiter  occurred  at  hypersonic  velocities  and 
extremely  high  altitudes,  and  the  debris  was  scattered  over 
a  wide  area.  Moreover,  the  initiating  event  preceded  the  ac- 
cident by  more  than  two  weeks.  In  pursuit  of  the  sequence  t)f 
the  cause,  investigators  developed  a  broad  array  of  infonna- 
tion  sources.  Evidence  was  derived  from  film  and  video  of 
the  launch,  radar  images  of  Coliinihia  on  orbit,  and  amateur 
video  of  debris  shedding  during  the  in-flight  breakup.  Data 
was  obtained  from  sensors  onboard  the  Orbiter  -  some  of 
this  data  was  downlinked  during  the  flight,  and  some  came 
from  an  on-board  recorder  that  was  recovered  during  the 
debris  search.  Analysis  of  the  debris  was  particularly  valu- 
able to  the  investigation.  Clues  were  to  be  found  not  only  in 
the  condition  of  the  pieces,  but  also  in  their  location  -  both 
where  they  had  been  on  the  Orbiter  and  where  they  were 
found  on  the  ground.  The  investigation  also  included  exten- 
sive computer  modeling,  impact  tests,  w  ind  tunnel  studies, 
and  other  analytical  techniques.  Each  of  these  avenues  of 
inquiry  is  described  in  this  chapter. 

Because  it  became  evident  that  the  key  event  in  the  chain 
leading  to  the  accident  involved  both  the  External  Tank  and 
one  of  the  Orbiter 's  wings,  the  chapter  includes  a  study  of 
these  two  structures.  The  understanding  of  the  accident's 
physical  cau.se  that  emerged  from  this  investigation  is  sum- 
marized in  the  statement  at  the  beginning  of  the  chapter.  In- 
cluded in  the  chapter  are  the  findings  and  recommendations 
of  the  Columbia  Accident  investigation  Board  that  are  based 
on  this  examination  of  the  physical  evidence. 

3.1    The  Physical  Cause 

The  physical  cause  of  the  loss  of  Columbia  and  its 
crew  was  a  breach  in  the  Thermal  Protection  System 
on  the  leading  edge  of  the  left  wing.  The  breacn  was 
initiated  by  a  piece  of  insulating  foam  that  separated 
from  the  left  bipod  ramp  of  the  External  Tank  and 
struck  the  wing  in  the  vicinity  of  the  lower  half  of  Rein- 
forced Carbon-Carbon  panel  8  at  81.9  seconds  after 
launch.   During  re-entry,  this  breach  in  the  Thermal 


Protection  System  allowed  superheated  air  to  pen- 
etrate the  leading-edge  insulation  and  progressively 
melt  the  aluminum  structure  of  the  left  wing,  resulting 
in  a  weakening  of  the  structure  until  increasing  aero- 
dynamic forces  caused  loss  of  control,  failure  of  the 
wing,  and  breakup  of  the  Orbiter. 


Figure  3.??.  Columbia  sitting  at  Launch  Complex  39A.  The  upper 
circle  shows  the  left  bipod  (-Y)  ramp  on  the  forward  attach  poinf, 
while  fhe  lower  circle  is  around  RCC  panel  8-left. 
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3.2    The  External  Tank  and  Foam 

The  External  Tank  is  the  largest  element  of  the  Space  Shuttle. 
Because  it  is  the  common  element  to  which  the  Solid  Rocket 
Boosters  and  the  Orbiter  are  connected,  it  serves  as  the  main 
structural  component  during  assembly,  launch,  and  ascent, 
it  also  fultills  the  role  of  the  low-temperature,  or  cryogenic, 
propellant  tank  for  the  Space  Shuttle  Main  Engines,  it  holds 
14.^,351  gallons  of  liquid  oxygen  at  minus  297  degrees 
Fahrenheit  in  its  forward  (upper)  tank  and  .^85.265  gallons 
of  liquid  hydrogen  at  minus  42.3  degrees  Fahrenheit  in  its  aft 
(lower)  tank.' 


Figure  3  21    The  major  components  of  the  External  Tank 


Lockheed  Mailin  builds  the  External  Tank  under  contract  to 
the  NASA  Marshall  Space  Flight  Center  at  the  Michoud  As- 
sembly Facility  in  eastern  New  Orleans,  Louisiana. 

The  External  Tank  is  constructed  primarily  of  aluminum  al- 
loys (mainly  2219  aluminum  alloy  for  standard-weight  and 
lightweight  tanks,  and  2195  Aluminum-Lithium  alloy  for 
super-lightweight  tanks),  with  steel  and  titanium  tittings  and 
attach  points,  and  some  composite  materials  in  fairings  and 
access  panels.  The  External  Tank  is  153.8  feet  long  and  27.6 
feet  in  diameter,  and  comprises  three  major  sections:  the  liq- 
uid oxygen  tank,  the  liquid  hydrogen  tank,  and  the  intertank 
area  between  them  (see  Figure  3.2- 1 ).  The  liquid  oxygen  and 
liquid  hydrogen  tanks  are  welded  assemblies  of  machined 
and  formed  panels,  barrel  sections,  ring  frarnes,  and  dome 
and  ogive  sections.  The  liquid  oxygen  tank  is  pressure-tested 
with  water,  and  the  liquid  hydrogen  tank  with  compressed  air, 
before  they  are  incorporated  into  the  External  Tank  assembly. 
STS-1()7  used  Lightweight  External  Tank-93. 
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Figure  3.2-2.  The  exterior  of  the  left  bipod  attachment  area  show- 
ing the  foam  ramp  that  came  off  during  the  ascent  of  STS-107. 


ternal  Tank  by  two  umbilical  fittings  at  the  bottom  (that  also 
contain  fluid  and  electrical  connections)  and  by  a  "bipod"  at 
the  top.  The  bipod  is  attached  to  the  External  Tank  by  fittings 
at  the  right  and  left  of  the  External  Tank  centerline.  The  bipod 
fittings,  which  are  titaniinii  forgings  bolted  to  the  External 
Tank,  are  forward  (above)  of  the  intetlank-liquid  hydrogen 
flange  joint  (see  Figures  3.2-2  and  3.2-3).  Each  forging  con- 
tains a  spindle  that  attaches  to  one  end  of  a  bipod  strut  and 
rotates  to  compensate  for  External  Tank  shrinkage  during  the 
loading  of  cryogenic  propellants. 


Liquid  Hydrogen  Tonk 
lo  Intertank  Flange 


Liquid  Hydrogen  Tank 


Figure  3,2-3.  Cutaway  drawing  of  the  bipod  ramp  and  its  associ- 
ated Fittings  and  hardware. 


The  propellant  tanks  are  connected  by  the  intertank.  a  22.5- 
foot-long  hollow  cylinder  made  of  eight  stiffened  aluininum 
alloy  panels  bolted  together  along  longitudinal  joints.  Two  of 
these  panels,  the  integrally  stiffened  thrust  panels  (.so  called 
because  they  react  to  the  Solid  Rocket  Booster  thrust  loads) 

are  located  on  the  sides  of  the  External  Tank  where  the  Solid 

Rocket  Boosters  are  mounted;  they  consist  of  single  slabs  of 

aluminum  alloy  machined  into  panels  with  solid  longitudinal  External  Tank  Thermal  Protection  System  Materials 

ribs.  The  thrust  panels  are  joined  across  the  inner  diameter 
by  the  intertank  truss,  the  major  structural  element  of  the 
External  Tank.  During  propellant  loading,  nitrogen  is  used  to 
purge  the  intertank  to  prevent  condensation  and  also  to  pre- 
vent liquid  oxygen  and  liquid  hydrogen  from  combining. 


The  External  Tank  is  attached  to  the  Solid  Rocket  Boosters 
by  bolts  and  fittings  on  the  thrust  panels  and  near  the  aft  end 
of  the  liquid  hydrogen  tank.  The  Orbiter  is  attached  to  the  Ex- 


The  External  Tank  is  coated  with  two  materials  that  serve 
as  the  Thermal  Protection  System:  dense  composite  ablators 
for  dissipating  heat,  and  low  density  closed-cell  foams  for 
high  insulation  efficiency.-  (Closed-cell  materials  consist 
of  small  pores  filled  with  air  and  blowing  agents  that  are 
separated  by  thin  membranes  of  the  foam's  polymeric  com- 
ponent.) The  External  Tank  Thermal  Protection  System  is 
designed  to  maintain  an  interior  temperature  that  keeps  the 
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Figure  3.2-4.  Locations  of  fhe  various  foam  systems  as  used  on  ET-93,  the  External  Tank  used  for  STS-W7. 


oxygen  and  hydrogen  in  a  liquid  state,  and  to  maintain  the 
temperature  of  external  parts  high  enough  to  prevent  ice  and 
frost  from  forming  on  the  surface.  Figure  3.2-4  summarizes 
the  foam  systems  used  on  the  External  Tank  for  STS-107. 

The  adhesion  between  spray ed-on  foam  insulation  and  the 
External  Tank's  aluminum  substrate  is  actually  quite  good, 
provided  that  the  substrate  has  been  properly  cleaned  and 
primed.  (Poor  surface  preparation  does  not  appear  to  have 
been  a  problem  in  the  past.)  In  addition,  large  areas  of  the 
aluminum  substrate  are  usually  heated  during  foam  appli- 
cation to  ensure  that  the  foam  cures  properly  and  develops 
the  maximum  adhesive  strength.  The  interface  between  the 
foam  and  the  aluminum  substrate  experiences  .stresses  due 
to  differences  in  how  much  the  aluminum  and  the  foam 
contract  when  subjected  to  cryogenic  temperatures,  and  due 
to  the  stresses  on  the  External  Tank's  aluminum  structure 
while  it  serves  as  the  backbone  of  the  Shuttle  stack.  While 
these  stresses  at  the  foam-aluminum  interface  are  certainly 
not  trivial,  they  do  not  appear  to  be  excessive,  since  very  few 
of  the  observed  foam  loss  events  indicated  that  the  foam  was 
lost  down  to  the  primed  aluminum  substrate. 

Throughout  the  history  of  the  External  Tank,  factors  unre- 
lated to  the  insulation  process  have  caused  foam  chemistry 
changes  (Environmental  Protection  Agency  regulations  and 
material  availability,  for  example).  The  most  recent  changes 
resulted  from  modifications  to  governmental  regulations  of 
chlorofiuorocarbons. 

Most  of  the  External  Tank  is  insulated  with  three  types  of 
spray-on  foam.  NCFI  24-124,  a  polyisocyanurate  foam  ap- 
plied with  blowing  agent  HCFC  141b  hydrochlorofluorocar- 


bon,  is  used  on  most  areas  of  the  liquid  oxygen  and  liquid 
hydrogen  tanks.  NCFI  24-57,  another  polyisocyanurate 
foam  applied  with  blowing  agent  HCFC  141b  hydrochlo- 
rofluorocarbon,  is  used  on  the  lower  liquid  hydrogen  tank 
dome.  BX-250,  a  polyurethane  foam  applied  with  CFC-li 
chlorofluorocarbon.  was  used  on  domes,  ramps,  and  areas 
where  the  foam  is  applied  by  hand.  The  foam  types  changed 
on  External  Tanks  built  after  External  Tank  93,  which  was 
used  on  STS- 107,  but  these  changes  are  beyond  the  scope  of 
this  section. 

Metallic  sections  of  the  External  Tank  that  will  be  insulated 
with  foam  are  first  coated  with  an  epoxy  primer.  In  some 
areas,  such  as  on  the  bipod  hand-sculpted  regions,  foam  is 
applied  directly  over  ablator  materials.  Where  foam  is  ap- 
plied over  cured  or  dried  foam,  a  bonding  enhancer  called 
Conathane  is  first  applied  to  aid  the  adhesion  between  the 
two  foam  coats. 

After  foam  is  applied  in  the  intertank  region,  the  larger  areas 
of  foam  coverage  are  machined  down  to  a  thickness  of  about 
an  inch.  Since  controlling  weight  is  a  major  concern  for  the 
External  Tank,  this  machining  serves  to  reduce  foam  thick- 
ness while  still  maintaining  sufficient  insulation. 

The  insulated  region  where  the  bipod  struts  attach  to  the 
External  Tank  is  structurally,  geometrically,  and  materially 
complex.  Because  of  concerns  that  foam  applied  over  the 
fittings  would  not  provide  enough  protection  from  the  high 
heating  of  exposed  surfaces  during  ascent,  the  bipod  fittings 
are  coated  with  ablators.  B.X-250  foam  is  sprayed  by  hand 
over  the  fittings  (and  ablator  materials),  allowed  to  dry,  and 
manually  shaved  into  a  ramp  shape.  The  foam  is  visually 
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inspected  at  the  Michoud  Assembly  Facility  and  also  at  the 
Kennedy  Space  Center,  but  no  other  non-destructive  evalu- 
ation is  performed. 

Since  the  Shuttle's  inaugural  flight,  the  shape  of  the  bipod 
ramp  has  changed  twice.  The  bipod  foam  ramps  on  External 
Tanks  I  through  13  originally  had  a  45-degree  ramp  angle. 
On  STS-7,  foam  was  lost  from  the  External  Tank  bipod 
ramp;  subsequent  wind  tunnel  testing  showed  that  shallower 
angles  were  aerodynamically  preferable.  The  ramp  angle 
was  changed  from  45  degrees  to  between  22  and  30  degrees 
on  External  Tank  14  and  later  tanks.  A  slight  modification 
to  the  ramp  impingement  profile,  implemented  on  External 
Tank  76  and  later,  was  the  last  ramp  geometry  change. 

STS-107  Left  Bipod  Foam  Romp  Loss 

A  combination  of  factors,  rather  than  a  single  factor,  led  to  the 
loss  of  the  left  bipod  foam  ramp  during  the  ascent  of  STS- 1 07. 
NASA  personnel  believe  that  testing  conducted  during  the 
investigation,  including  the  dissection  of  as-built  hardware 
and  testing  of  simulated  defects,  showed  conclusively  that 
pre-existing  defects  in  the  foam  were  a  major  factor,  and  in 
briefings  tO'the  Board,  these  were  cited  as  a  necessary  condi- 
tion for  foam  loss.  However,  analysis  indicated  that  pre-ex- 
isting defects  alone  were  not  responsible  for  foam  loss. 

The  basic  External  Tank  was  designed  more  than  30  years 
ago.  The  design  process  then  was  substantially  different 
than  it  is  today,  in  the  1970s,  engineers  often  developed  par- 
ticular facets  of  a  design  (structural,  thermal,  and  .so  on)  one 
after  another  and  in  relative  isolation  from  other  engineers 
working  on  different  facets.  Today,  engineers  usually  work 
together  on  all  aspects  of  a  design  as  an  integrated  team. 
The  bipod  fitting  was  designed  first  from  a  structural  stand- 
point, and  the  application  processes  for  foam  (to  prevent  ice 
formation)  and  Super  Lightweight  Ablator  (to  protect  from 
high  heating)  were  developed  separately.  Unfortunately,  the 
structurally  optimum  fitting  design,  along  with  the  geomet- 
ric complexity  of  its  location  (near  the  flange  between  the  in- 
tertank  and  the  liquid  hydrogen  tank),  posed  many  problems 
in  the  application  of  foam  and  Super  Lightweight  Ablator 
that  would  lead  to  foam-ramp  defects. 

Although  there  is  no  evidence  that  substandard  methods 
were  used  to  qualify  the  bipod  ramp  design,  tests  made  near- 
ly three  decades  ago  were  rudimentary  by  today's  standards 
and  capabilities.  Also,  testing  did  not  follow  the  often-used 
engineering  and  design  philosophy  of  "Fly  what  you  test  and 
test  what  you  fly."  Wind  tunnel  tests  observed  the  aerody- 
namics and  strength  of  two  geometries  of  foam  bipod  enclo- 
sures (flat-faced  and  a  20-degree  ramp),  but  these  tests  were 
done  on  essentially  solid  foam  blocks  that  were  not  sprayed 
onto  the  complex  bipod  fitting  geometry.  Extensive  mate- 
rial property  tests  gauged  the  strength,  insulating  potential, 
and  ablative  characteristics  of  foam  and  Super  Lightweight 
Ablator  specimens. 

It  was  -  and  still  is  -  impossible  to  conduct  a  ground-based, 
simultaneous,  full-scale  simulation  of  the  combination 
of  loads,  airflows,  temperatures,  pressures,  vibration,  and 
acoustics  the  External  Tank  experiences  during  launch  and 


ascent.  Therefore,  the  qualification  testing  did  not  truly  re- 
flect the  combination  of  factors  the  bipod  would  experience 
during  flight.  Engineers  and  designers  used  the  best  meth- 
ods available  at  the  time:  test  the  bipod  and  foam  under  as 
many  severe  combinations  as  could  be  simulated  and  then 
interpolate  the  results.  Various  analyses  determined  stresses, 
thermal  gradients,  air  loads,  and  other  conditions  that  could 
not  be  obtained  through  testing. 

Significant  analytical  advancements  have  been  made  since 
the  External  Tank  was  first  conceived,  particularly  in  com- 
putational fluid  dynamics  (see  Figure  3.2-5).  Computational 
fluid  dynamics  comprises  a  computer-generated  model  that 
represents  a  system  or  device  and  uses  fluid-flow  physics 
and  software  to  create  predictions  of  flow  behavior,  and 
stress  or  deformation  of  solid  structures.  However,  analysis 
must  always  be  verified  by  test  and/or  flight  data.  The  Exter- 
nal Tank  and  the  bipod  ramp  were  not  tested  in  the  complex 
flight  environment,  nor  were  fully  instrumented  External 
Tanks  ever  launched  to  gather  data  for  verifying  analytical 
tools.  The  accuracy  of  the  analytical  tools  used  to  simulate 
the  External  Tank  and  bipod  ramp  were  verified  only  by  us- 
ing flight  and  test  data  from  other  Space  Shuttle  regions. 


Figure  3.2-5.  Compufational  Fluid  Dynamics  was  used  fo  under- 
stand the  complex  flow  Fields  and  pressure  coefficienfs  around 
bipod  sirui.  The  flight  conditions  shown  here  approximate  those 
present  when  the  left  bipod  foam  ramp  was  lost  from  External 
Tank  93  at  Mach  2.46  at  a  2.08-degree  angle  of  attack. 


Further  complicating  this  problem,  foam  does  not  have  the 
same  properties  in  all  directions,  and  there  is  also  variability 
in  the  foam  it.self.  Because  it  consists  of  small  hollow  cells, 
it  does  not  have  the  same  composition  at  every  point.  This 
combination  of  properties  and  composition  makes  foam 
extremely  difficult  to  model  analytically  or  to  characterize 
physically.  The  great  variability  in  its  properties  makes  for 
difficulty  in  predicting  its  response  in  even  relatively  static 
conditions,  much  less  during  the  launch  and  ascent  of  the 
Shuttle.  And  too  little  effort  went  into  understanding  the 
origins  of  this  variability  and  its  failure  modes. 

The  way  the  foam  was  produced  and  applied,  particularly 
in  the  bipod  region,  also  contributed  to  its  variability.  Foam 
consists  of  two  chemical  components  that  must  be  mixed 
in  an  exact  ratio  and  is  then  sprayed  according  to  strict 
specifications.  Foam  is  applied  to  the  bipod  fitting  by  hand 
to  make  the  foam  ramp,  and  this  process  may  be  the  primar> 
source  of  foam  variability.  Board-directed  dissection  of 
foam  ramps  has  revealed  that  defects  (voids,  pockets,  and 
debris)  are  likely  due  to  a  lack  of  control  of  various  combi- 
nations of  parameters  in  spray-by-hand  applications,  which 
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is  exacerbated  by  the  complexity  of  the  underlying  hardware 
configuration.  These  defects  often  occur  along  "knit  lines." 
the  boundaries  between  each  layer  that  are  formed  by  the 
repeated  application  of  thin  layers  -  a  detail  of  the  spray-by- 
hand  process  that  contributes  to  foam  variability,  suggesting 
that  while  foam  is  sprayed  according  to  approved  proce- 
dures, these  procedures  may  be  questionable  if  the  people 
who  devised  them  did  not  have  a  sufficient  understanding  of 
the  properties  of  the  foam. 

Subsurface  defects  can  be  detected  only  by  cutting  away  the 
foam  to  examine  the  interior.  Non-destructive  evaluation 
techniques  for  determining  External  Tank  foam  strength 
have  not  been  perfected  or  qualified  (although  non-destruc- 
tive testing  has  been  used  successfully  on  the  foam  on 
Boeing's  new  Delta  IV  booster,  a  design  of  much  simpler 
geometry  than  the  External  Tank).  Therefore,  it  has  been  im- 
possible to  determine  the  quality  of  foam  bipod  ramps  on  any 
External  Tank.  Furthemiore.  multiple  defects  in  some  cases 
can  combine  to  weaken  the  foam  along  a  line  or  plane. 

"Cryopumping"  has  long  been  theorized  as  one  of  the 
processes  contributing  to  foam  loss  from  larger  areas  of 
coverage.  If  there  are  cracks  in  the  foam,  and  if  these  cracks 
lead  through  the  foam  to  voids  at  or  near  the  surface  of  the 
liquid  oxygen  and  liquid  hydrogen  tanks,  then  air,  chilled 
by  the  extremely  low  temperatures  of  the  cryogenic  tanks, 
can  liquefy  in  the  voids.  After  launch,  as  propellant  levels 
fall  and  aerodynamic  heating  of  the  exterior  increases,  the 
temperature  of  the  trapped  air  can  increase,  leading  to  boil- 
ing and  evaporation  of  the  liquid,  with  concurrent  buildup  of 
pressure  within  the  foam.  It  was  believed  that  the  resulting 
rapid  increase  in  subsurface  pressure  could  cause  foam  to 
break  away  from  the  External  Tank. 

"Cryoingestion"  follows  essentially  the  same  scenario, 
except  it  involves  gaseous  nitrogen  seeping  out  of  the  in- 
tertank  and  liquefying  inside  a  foam  void  or  collecting  in 
the  Super  Lightweight  Ablator.  (The  intertank  is  filled  with 
nitrogen  during  tanking  operations  to  prevent  condensation 
and  also  to  prevent  liquid  hydrogen  and  liquid  oxygen  from 
combining.)  Liquefying  would  most  likely  occur  in  the 
circumferential  "Y"  joint,  where  the  liquid  hydrogen  tank 
mates  with  the  intertank,  just  above  the  liquid  hydrogen-in- 
tertank  flange.  The  bipod  foam  ramps  straddle  this  complex 
feature.  If  pooled  liquid  nitrogen  contacts  the  liquid  hydro- 
gen tank,  it  can  solidify,  because  the  freezing  temperature 
of  liquid  nitrogen  (minus  348  degrees  Fahrenheit)  is  higher 
than  the  temperature  of  liquid  hydrogen  (minus  423  degrees 
Fahrenheit).  As  with  cryopumping.  cryoingested  liquid  or 
solid  nitrogen  could  also  "flash  evaporate"  during  launch 
and  ascent,  causing  the  foam  to  crack  off.  Several  paths  al- 
low gaseous  nitrogen  to  escape  from  the  intertank.  including 
beneath  the  flange,  between  the  intertank  panels,  through 
the  rivet  holes  that  connect  stringers  to  intertank  panels,  and 
through  vent  holes  beneath  the  stringers  that  prevent  over- 
pressurization  of  the  stringers. 

No  evidence  suggests  that  defects  or  cryo-effects  alone 
caused  the  loss  of  the  left  bipod  foam  ramp  from  the 
STS-107  External  Tank.  Indeed,  NASA  calculations  have 
suggested  that  during  ascent,  the  Super  Lightweight  Ablator 


remains  just  slightly  above  the  temperature  at  which  nitro- 
gen liquefies,  and  that  the  outer  wall  of  the  hydrogen  tank 
near  the  bipod  ramp  does  not  reach  the  temperature  at  which 
nitrogen  boils  until  130  seconds  into  the  flight,'  which  is  too 
late  to  explain  the  only  two  bipod  ramp  foam  losses  whose 
times  during  ascent  are  known.  Recent  tests  at  the  Marshall 
Space  Flight  Center  revealed  that  flight  conditions  could 
permit  ingestion  of  nitrogen  or  air  into  subsurface  foam, 
but  would  not  permit  "flash  evaporation"  and  a  sufficient 
subsurface  pressure  increase  to  crack  the  foam.  When 
conditions  are  modified  to  force  a  flash  evaporation,  the 
failure  mode  in  the  foam  is  a  crack  that  provides  pressure 
relief  rather  than  explosive  cracking.  Therefore,  the  flight 
environment  itself  must  also  have  played  a  role.  Aerody- 
namic loads,  thermal  and  vacuum  effects,  vibrations,  stress 
in  the  External  Tank  structure,  and  myriad  other  conditions 
may  have  contributed  to  the  growth  of  subsurface  defects, 
weakening  the  foam  ramp  until  it  could  no  longer  withstand 
flight  conditions. 

Conditions  in  ceilain  combinations  during  ascent  may  also 
have  contributed  to  the  loss  of  the  foam  ramp,  even  if  in- 
dividually they  were  well  within  design  certification  limits. 
These  include  a  wind  shear,  associated  Solid  Rocket  Booster 
and  Space  Shuttle  Main  Engine  responses,  and  liquid  oxy- 
gen sloshing  in  the  External  Tank.""  Each  of  these  conditions, 
alone,  does  not  appear  to  have  caused  the  foam  loss,  but 
their  contribution  to  the  event  in  combination  is  unknown. 

Negligence  on  the  part  of  NASA.  Lockheed  Martin,  or  United 
Space  Alliance  workers  does  not  appear  to  have  been  a  fac- 
tor. There  is  no  evidence  of  sabotage,  either  during  produc- 
tion or  pre-launch.  Although  a  Problem  Report  was  written 
for  a  small  area  of  crushed  foam  near  the  left  bipod  (a  condi- 
tion on  nearly  every  flight),  this  affected  only  a  very  small 
region  and  does  not  appear  to  have  contributed  to  the  loss  of 
the  ramp  (see  Chapter  4  for  a  fuller  discussion).  Nor  does  the 
basic  quality  of  the  foam  appear  to  be  a  concern.  Many  of  the 
basic  components  are  continually  and  meticulously  tested  for 
quality  before  they  are  applied.  Finally,  despite  commonly 
held  perceptions,  numerous  tests  show  that  moisture  absorp- 
tion and  ice  formation  in  the  foam  appears  negligible. 

Foam  loss  has  occurred  on  more  than  SO  percent  of  the  79 
missions  for  which  imagery  is  available,  and  foam  was  lost 
from  the  left  bipod  ramp  on  nearly  10  percent  of  missions 
where  the  left  bipod  ramp  was  visible  following  External 
Tank  separation.  For  about  30  percent  of  all  missions,  there 
is  no  way  to  determine  if  foam  was  lost;  these  were  either 
night  launches,  or  the  External  Tank  bipod  ramp  areas  were 
not  in  view  when  the  images  were  taken.  The  External  Tank 
was  not  designed  to  be  instrumented  or  recovered  after 
separation,  which  deprives  NASA  of  physical  evidence  that 
could  help  pinpoint  why  foam  separates  from  it. 

The  precise  reasons  why  the  left  bipod  foam  ramp  was  lost 
from  the  External  Tank  during  STS- 1 07  may  never  be  known. 
The  specific  initiating  event  may  likewise  remain  a  mystery. 
However,  it  is  evident  that  a  combination  of  variable  and 
pre-existing  factors,  such  as  insufficient  testing  and  analysis 
in  the  early  design  stages,  resulted  in  a  highly  variable  and 
complex  foam  material,  defects  induced  by  an  imperfect 
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Foam  Fracture  Under  Hydrostatic  Pressure 


The  Board  has  concluded  that  the  physical  cause  of  the  breakup  of 
Columbia  upon  re-entr>'  was  the  result  of  damage  to  the  Orbiter's 
rhermal  Protection  System,  which  occurred  when  a  large  piece  of 
BX-250  foam  insulation  fell  from  the  left  (-Y)  bipod  assembly  81.7 
seconds  after  launch  and  struck  the  leading  edge  of  the  left  wing.  As 
the  Hxlernal  Tank  is  covered  with  insulating  foam,  it  seemed  to  me 
essential  that  we  understand  the  mechanisms  that  could  cause  foam 
to  shed. 

Many  if  not  most  of  the  systems  in  the  three  components  of  the 
Shuttle  stack  (Orbiter,  External  Tank,  and  Solid  Rocket  Boosters)  are 
by  themselves  complex,  and  often  operate  near  the  limits  of  their  per- 
formance. Attempts  to  understand  their  complex  behavior  and  failure 
modes  are  hampered  by  their  strong  interactions  with  other  systems 
in  the  stack,  through  their  shared  environment.  The  foam  of  the  Ther- 
mal Protection  System  is  no  exception.  To  understand  the  behavior 
of  systems  under  such  circumstances,  one  must  first  understand  their 
behavior  in  relatively  simple  limits.  Using  this  understanding  as  a 
guide,  one  is  much  more  likely  to  determine  the  mechanisms  of  com- 
plex behavior,  such  as  the  shedding  of  foam  from  the  -Y  bipod  ramp, 
than  simply  creating  simulations  of  the  complex  behavior  itself. 

I  approachcj.!  this  problem  by  trying  to  im;iginc  the  fracture  mecha- 
nism by  which  fluid  pressure  built  up  inside  the  foam  could  propagate 
to  the  surface,  Determining  this  process  is  clearly  key  to  understand- 
ing foam  ejection  through  the  heating  of  cryogenic  fluids  trapped  in 
voids  beneath  the  surface  of  the  foam,  either  through  "cryopumping" 
or  "cryoingcstion."  I  started  by  imagining  a  fluid  under  hydrostatic 
pressure  in  contact  with  the  surface  of  such  foam.  It  seemed  clear 
that  as  the  pressure  increased,  it  would  cause  the  weakest  cell  wall 
to  burst,  filling  the  adjacent  cell  with  the  fluid,  and  exerting  the  same 
hydrostatic  pressure  on  all  the  walls  of  that  cell.  What  happened  next 
was  unclear.  It  was  possible  that  the  next  cell  wall  to  burst  would  not 
be  one  of  the  walls  of  the  newly  filled  cell,  but  some  other  cell  that 
had  been  on  the  surface  that  was  initially  subjected  to  the  fluid  pres- 
sure. This  seemed  like  a  rather  complex  process,  and  1  questioned  my 
ability  to  include  all  the  physics  correctly  if  1  tried  to  model  it.  In- 
stead, l>chose  to  perform  an  experiment  that  seemed  straightforward, 
but  which  had  a  result  1  could  not  have  foreseen. 

1  glued  a  1.25-inch-thick  piece  of  BX-25()  foam  to  a  ().25-inch-thick 
brass  plate.  The  .Vby-3-inch  plate  had  a  0.25-inch-diameter  hole  in 
its  center,  into  which  a  brass  tube  was  soldered.  The  tube  v\as  filled 
with  a  liquid  dye.  and  the  air  pressure  above  the  dye  could  be  slowly 
raised,  using  a  battery-operated  tire  pump  to  which  a  pressure  regu- 
lator was  attached  until  the  fluid  was  forced  through  the  foam  to  its 
outer  surface.  Not  know ing  what  to  expect,  the  first  lime  1  tried  this 
experiment  with  my  graduate  student,  ,lim  Baumgardner,  we  did 
so  out  on  the  loading  dock  of  the  Stanford  Physics  Department.  If 
this  process  were  to  mimic  the  cryoejcction  t)f  foam,  we  expected 
a  violent  explosion  when  the  pressure  burst  through  the  surface.  To 
keep  from  being  showered  w  ith  dye,  we  put  the  assembly  in  a  closed 
cardboard  box,  and  donned  white  lab  coats. 

Instead  of  a  loud  explosion,  we  heard  nothing.  We  found,  though,  that 
the  pressure  above  the  liquid  began  dro])ping  <ince  the  gas  pressure 
reached  about  4.S  pounds  per  square  inch.  [Releasing  the  pressure  and 
opening  the  box,  we  found  a  thin  crack,  about  a  half-inch  long,  at  the 
upper  surface  of  the  foam.  Curious  about  the  path  the  pressure  had 
taken  to  reach  the  surface.  1  cut  the  foam  off  the  brass  plate,  and  made 
two  vertical  cuts  through  the  foam  in  line  with  the  crack.  When  I  bent 
the  foam  in  line  with  the  crack,  it  separated  into  two  sections  along 
the  crack.  The  dye  served  as  a  tracer  for  where  the  fluid  had  traveled 
in  its  path  through  the  foam.  This  path  was  along  a  flat  plane,  and  was 


the  shape  of  a  teardrop  that  intersected  perpendicular  to  the  upper 
surface  of  the  foam.  Since  the  pressure  could  only  exert  force  in  the 
two  directions  peq^endicular  to  this  fault  plane,  it  could  not  possibly 
result  in  the  ejection  of  foam,  because  that  would  require  a  force  per- 
pendicular to  the  surface  of  the  foam.  I  repeated  this  experiment  with 
several  pieces  of  foam  and  always  found  the  same  behavior. 

I  was  curious  why  the  path  of  the  pressure  fault  was  planar,  and  why 
it  had  propagated  upward,  nearly  perpendicular  to  the  outer  surface 
of  the  foam.  For  this  sample,  and  most  of  the  samples  that  NASA 
had  given  me.  the  direction  of  growth  of  the  foam  was  vertical,  as 
evidenced  by  horizontal  "knit  lines"  that  result  from  successive  ap- 
plications of  the  sprayed  foam.  The  knit  lines  are  perpendicular  to 
the  growth  direction.  1  then  guessed  that  the  growth  of  the  pressure 
fault  was  influenced  by  the  foam's  direction  of  growth.  To  lest  this 
hypothesis,  I  found  a  piece  of  foam  for  which  the  growth  direction 
was  vertical  near  the  top  surface  of  the  foam,  but  was  at  an  approxi- 
mately 45-degree  angle  to  the  vertical  near  the  bottom.  If  my  hypoth- 
esis were  correct,  the  direction  of  growth  of  the  pressure  fault  would 
follow  the  direction  of  growth  of  the  foam,  and  hence  would  always 
intersect  the  knit  lines  at  90  degrees.  Indeed,  this  was  the  case. 

The  reason  the  pressure  fault  is  planar  has  to  do  with  the  fact  that 
such  a  geometry  can  amplify  the  fluid  pressure,  creating  a  much 
greater  stress  on  the  cell  walls  near  the  outer  edges  of  the  teardrop, 
for  a  given  hydrostatic  pressure,  than  would  exist  for  a  spherical 
pressure-filled  void.  A  pressure  fault  follows  the  direction  of  foam 
growth  because  more  cell  walls  have  their  surfaces  along  this  direc- 
tion than  along  any  other.  The  stiffness  of  the  foam  is  highest  when 
you  apply  a  force  parallel  to  the  cell  walls.  If  you  squeeze  a  cube  of 
foam  in  various  directions,  you  find  that  the  foam  is  stiffest  along  its 
growth  direction.  By  advancing  along  the  stiff  direction,  the  crack  is 
oriented  so  that  the  fluid  pressure  can  more  easily  force  the  (nearly) 
planar  walls  of  the  crack  apart. 

Because  the  pressure  fault  intersects  perpendicular  to  the  upper  sur- 
face, hydrostatic  pressure  will  generally  not  lead  to  foam  shedding. 
There  are,  however,  cases  where  pressure  can  lead  to  foam  shedding, 
but  this  will  only  occur  when  the  fluid  pressure  exists  over  an  area 
whose  dimensions  are  large  compared  to  the  thickness  of  the  foam 
above  it.  and  roughly  parallel  to  the  outer  surface.  This  would  require 
a  large  structural  defect  within  the  foam,  such  as  the  delamination 
of  the  foam  from  its  substrate  or  the  separation  of  the  foam  at  a  knit 
line.  Such  large  defects  are  quite  different  from  the  small  voids  that 
occur  when  gravity  causes  uncured  foam  to  "roll  over"  and  trap  a 
small  bubble  of  air. 

Experiments  like  this  help  us  Luidersiand  how  foam  shedding  does 
(and  doesn't)  occur,  because  they  elucidate  the  properties  of  "per- 
fect" foam,  free  from  voids  and  other  defects.  Thus,  this  behavior 
represents  the  true  behavior  of  the  foam,  free  from  defects  that  may 
or  may  not  have  been  present.  In  addition,  these  exj'Hjrimcnts  are  fast 
and  cheap,  since  they  can  be  carried  out  on  relatively  small  pieces  of 
foam  in  simple  environments.  Finally,  we  can  understand  why  the 
observed  behavior  occurs  from  our  imderstanding  of  the  basic  physi- 
cal properties  of  the  foam  itself.  B)  contrast,  if  you  wish  to  mimic 
left  bipod  foam  loss,  keep  in  mind  that  such  loss  could  have  been 
detected  only  7  times  in  72  instances.  Thus,  not  observing  foam  loss 
in  a  particular  experiment  will  not  insure  that  it  would  ne\er  happen 
under  the  same  conditions  at  a  later  time.  NASA  is  now  undertaking 
both  kinds  of  experiments,  but  it  is  the  simple  studies  that  so  far  have 
most  contributed  to  our  understanding  of  foam  failure  modes. 

Douglas  Osliero/J.  Board  Member 


Report    Voli 


August     2003 


COLUMBIA 

ACCIDENT  INVESTIGATION  BDARO 


and  variable  application,  and  the  results  of  that  imperfect 
process,  as  well  as  severe  load,  thermal,  pressure,  vibration, 
acoustic,  and  structural  launch  and  ascent  conditions. 

Findings: 

F3.2-1  NASA  does  not  fully  understand  the  mechanisms 
that  cause  foam  loss  on  almost  all  flights  from 
larger  areas  of  foam  coverage  and  from  areas  that 
are  sculpted  by  hand. 

F3.2-2  There  are  no  qualified  non-destnictive  evaluation 
techniques  for  the  as-installed  foam  to  determine 
the  characteristics  of  the  foam  before  flight. 

F3.2-3  Foam  loss  from  an  External  Tank  is  unrelated  to 
the  tank's  age  and  to  its  total  pre-launch  expo- 
sure to  the  elements.  Therefore,  the  foam  loss  on 
STS-107  is  unrelated  to  either  the  age  or  expo- 
sure of  External  Tank  93  before  launch. 

F3.2-4  The  Board  found  no  indications  of  negligence 
in  the  application  of  the  External  Tank  Thermal 
Protection  System. 

F3.2-5  The  Board  found  instances  of  left  bipod  ramp 
shedding  on  launch  that  NASA  was  not  aware  of. 
bringing  the  total  known  left  bipod  ramp  shed- 
ding events  to  7  out  of  72  missions  for  which  im- 
agery of  the  launch  or  External  Tank  separation 
is  available. 

F3.2-6  Subsurface  defects  were  found  during  the  dissec- 
tion of  three  bipod  foam  ramps,  suggesting  that 
similar  defects  were  likely  present  in  the  left  bi- 
pod ramp  of  External  Tank  93  used  on  STS-107. 

F3.2-7  Foam  loss  occurred  on  more  than  80  percent  of 
the  79  missions  for  which  imagery  was  available 
to  confirm  or  rule  out  foam  loss. 

F3.2-8  Thirty  percent  of  all  missions  lacked  sufficient 
imagery  to  determine  if  foam  had  been  lost. 

F3.2-9  Analysis  of  numerous  separate  variables  indi- 
cated that  none  could  be  identified  as  the  sole 
initiating  factor  of  bipod  foam  loss.  The  Board 
therefore  concludes  that  a  combination  of  several 
factors  resulted  in  bipod  foam  loss. 

Recommendation: 

R3.2-1  Initiate  an  aggressive  program  to  eliminate  all 
External  Tank  Thermal  Protection  System  de- 
bris-shedding at  the  source  with  particular  em- 
phasis on  the  region  where  the  bipod  struts  attach 
to  the  External  Tank. 

3.3    Wing  Leading  Edge 
Structural  Subsystem 

The  components  of  the  Orbiter's  wing  leading  edge  pro- 
vide the  aerodynamic  load  bearing,  structural,  and  thermal 
control  capability  for  areas  that  exceed  2. .^00  degrees 
Fahrenheit.  Key  design  requirements  included  flying  100 
missions  with  minimal  refurbishment,  maintaining  the  alu- 
minum wing  structure  at  less  than  ?>50  degrees  Fahrenheit, 
withstanding  a  kinetic  energy  impact  of  0.006  foot-pounds, 
and  the  ability  to  withstand  1 .4  times  the  load  ever  expected 
in  operation.^  The  requirements  specifically  stated  that  the 


Reinforced  Carbon-Carbon  (RCC) 

The  basic  RCC  composite  is  a  laminate  of  graphite-impreg- 
nated rayon  fabric,  further  impregnated  with  phenolic  resin 
and  layered,  one  ply  at  a  time,  in  a  unique  moid  for  each  part, 
then  cured,  rough-trimmed,  drilled,  and  inspected.  The  part 
is  then  packed  in  calcined  coke  and  fired  in  a  furnace  to  con- 
vert it  to  carbon  and  is  made  more  dense  by  three  cycles  of 
fiirfuryl  alcohol  \acuum  impregnation  and  firing. 

To  pre\ent  oxidation,  the  outer  layers  of  the  carbon  substrate 
are  converted  into  a  0.02-to-().()4-inch-thick  layer  of  silicon 
carbide  in  a  chamber  filled  with  argon  at  temperatures  up 
to  3.000  degrees  Fahrenheit.  As  the  silicon  carbide  cools, 
"craze  cracks"  fomi  because  the  thermal  expansion  rates  of 
the  silicon  carbide  and  the  carbon  substrate  differ  The  part  is 
then  repeated!)  \acuum-impregnalcd  with  tctraethyl  ortho- 
silicate  to  till  the  pores  in  the  substrate,  and  the  craze  cracks 
are  filled  with  a  sealant. 


wing  leading  edge  would  not  need  to  withstand  iinpact  from 
debris  or  ice.  since  these  objects  would  not  pose  a  threat  dur- 
ing the  launch  phase.'' 

Reinforced  Carbon-Carbon 

The  development  of  Reinforced  Carbon-Carbon  (RCC)  as 
part  of  the  Thermal  Protection  System  was  key  to  meeting 
the  wing  leading  edge  design  requirements.  Developed  by 
Ling-Temco-Vought  (now  Lockheed  Mailin  Missiles  and 
Fire  Control),  RCC  is  used  for  the  Orbiter  nose  cap,  chin 
panel,  forward  External  Tank  attachment  point,  and  wing 
leading  edge  panels  and  T-seals.  RCC  is  a  hard  structural 
inaterial,  with  reasonable  strength  across  its  operational 
teinperature  range  (ininus  2.50  degrees  Fahrenheit  to  3,000 
degrees).  Its  low  thermal  expansion  coefficient  minimizes 
thermal  shock  and  themioelastic  stress. 

Each  wing  leading  edge  consists  of  22  RCC  panels  (see 
Figure  3.3-1).  nuinbered  from  1  to  22  moving  outward  on 
each  wing  (the  nomenclature  is  "5-left"  or  ".5-right"  to  dif- 
ferentiate, for  example,  the  two  number  5  panels).  Because 
the  shape  of  the  wing  changes  from  inboard  to  outboard, 
each  panel  is  unique. 


Figure  3.3-J.  There  are  22  panels  of  Reinforced  Carbon-Carbon 
on  eacfi  wing,  numbered  os  shown  above. 
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Wing  Leading  Edge  Damage 

The  risk  of  micrometeoroid  or  debris  damage  to  the  RCC 
panels  has  been  evaluated  several  times.  Hypervelocity  im- 
pact testing,  using  nylon,  glass,  and  aluminum  projectiles, 
as  well  as  low-velocity  impact  testing  with  ice,  aluminum, 
steel,  and  lead  projectiles,  resulted  in  the  addition  of  a  0.03-  to 
0.06-inch-thick  layer  of  Ne\tel-440  fabric  between  the  Inco- 
nel  foil  and  Cerachrome  insulation.  Analysis  of  the  design 
change  predicts  that  the  Orbiter  could  survive  re-entiT  with 
a  quarter-inch  diameter  hole  in  the  lower  surfaces  of  RCC 
panels  8  through  10  or  with  a  one-inch  hole  in  the  rest  of  the 
RCC  panels. 

RCC  components  have  been  struck  by  objects  throughout 
their  operational  life,  but  none  of  these  components  has  been 
completely  penetrated.  A  sampling  of  21  post-flight  reports 
noted  43  hypervelocity  impacts,  the  largest  being  0.2  inch. 
The  most  signiticant  low-velocity  impact  was  to  Atlantis' 
panel  lO-right  during  STS-45  in  March  and  April  1992.  The 
damaged  area  was  1.9  inches  by  1.6  inches  on  the  exterior 
surface  and  0.5  inches  by  0.1  inches  in  the  interior  surface. 
The  substrate  was  exposed  and  oxidized,  and  the  panel  was 
scrapped.  Analysis  concluded  that  the  damage  was  caused 
by  a  strike  by  a  man-made  object,  possibly  during  ascent. 
Figures  3.3-2  and  3.3-3  show  the  damage  to  the  outer  and 
iiiiiei'  surfaces.  i-especli\cl\ 


Figure  3.3-2.  Damage  on  the  oufer  surface  of  RCC  panel  lO-righf 
from  Aflanfis  after  STS-45. 


Figure  3.3-3.  Damage  on  the  inner  surface  of  RCC  panel  10-right 
from  Atlantis  after  STS-45. 


Leading  Edge  Maintenance 

Post-flight  RCC  component  inspections  for  cracks,  chips, 
scratches,  pinholes,  and  abnormal  discoloration  are  primar- 
ily visual,  with  tactile  evaluations  (pushing  with  a  finger) 
of  some  regions.  Boeing  personnel  at  the  Kennedy  Space 
Center  make  minor  repairs  to  the  silicon  carbide  coating  and 
surface  defects. 

With  the  goal  of  a  long  service  life,  panels  6  through  1 7  are 
refurbished  every  18  missions,  and  panels  18  and  19  every 
36  missions.  The  remaining  panels  have  no  specific  refur- 
bishment requirement. 

At  the  lime  of  STS-107,  most  of  the  RCC  panels  on 
Coliiinhia's  left  wing  were  original  equipment,  but  panel 
lO-left,  T-seal  lO-left,  panel  1 1 -left,  and  T-seal  1 1 -left  had 
been  replaced  (along  with  panel  12  on  the  right  wing).  Panel 
lO-left  was  tested  to  destruction  after  19  flights.  Minor  sur- 
face repairs  had  been  made  to  panels  5,  7,  10,  II,  12,  13,  and 
19  and  T-seals  3,  II,  12.  13,  14,  and  19.  Panels  and  T-seals 
6  through  9  and  1 1  through  17  of  the  left  wing  had  been 
refurbished. 

Reinforced  Carbon-Carbon  Mission  Life 

The  rate  of  oxidation  is  the  most  important  variable  in  de- 
termining the  mission  life  of  RCC  components.  Oxidation 
of  the  carbon  substrate  results  when  oxygen  penetrates  the 
microscopic  pores  or  fissures  of  the  silicon  carbide  protec- 
tive coating.  The  subsequent  loss  of  mass  due  to  oxidation 
reduces  the  load  the  structure  can  carry  and  is  the  basis  for 
establishing  a  mission  life  limit.  The  oxidation  rate  is  a  func- 
tion of  temperature,  pressure,  time,  and  the  type  of  heating. 
Repeated  exposure  to  the  Orbiter"s  normal  flight  environ- 
ment degrades  the  protective  coating  system  and  accelerates 
the  loss  of  mass,  which  weakens  components  and  reduces 
mission  life  capability. 

Currently,  mass  loss  of  flown  RCC  components  cannot  be 
directly  measured.  Instead,  mass  loss  and  mission  life  reduc- 
tion are  predicted  analytically  using  a  methodology  based  on 
mass  loss  rates  experimentally  derived  in  simulated  re-entry 
environments.  This  approach  then  uses  derived  re-entry 
temperature-time  profiles  of  various  portions  of  RCC  com- 
ponents to  estimate  the  actual  re-entry  mass  loss. 

For  the  first  five  missions  of  Coluiiihia.  the  RCC  compo- 
nents were  not  coated  with  Type  A  sealant,  and  had  shorter 
mission  service  lives  than  the  RCC  components  on  the 
other  Orbiters.  {Columbia's  panel  9  has  the  shortest  mis- 
sion service  life  of  50  flights  as  shown  in  Figure  3.3-4.)  The 
predicted  life  tor  panel/T-seals  7  through  16  range  from  54 
to  97  flights." 

Localized  penetration  of  the  protective  coating  on  RCC 
components  (pinholes)  were  first  discovered  on  Columbia  in 
1992,  after  STS-50,  Columbia'^,  12th  flight.  Pinholes  were 
later  found  in  all  Orbiters.  and  their  quantity  and  size  have 
increased  as  flights  continue.  Tests  showed  that  pinholes 
were  caused  by  zinc  oxide  contamination  from  a  primer 
used  on  the  launch  pad. 
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Figure  3.3-4.  The  expected  mission  life  for  each  of  the  wing  lead- 
ing edge  RCC  panels  on  Columbia.  Note  fhat  panel  9  has  fhe 
shortest  life  expectancy. 


In  October  1 993,  panel  1 2-right  was  removed  from  Cohimhia 
after  its  15th  flight  for  destructive  evaluation.  Optical  and 
scanning  electron  microscope  examinations  of  15  pinholes 
revealed  that  a  majority  occurred  along  craze  cracks  in  the 
thick  regions  of  the  silicon  carbide  layer.  Pinhole  glass 
chemistry  revealed  the  presence  of  zinc,  silicon,  oxygen, 
and  aluminum.  There  is  no  zinc  in  the  leading  edge  sup- 
port system,  but  the  launch  pad  corrosion  protection  system 
uses  an  inorganic  zinc  primer  under  a  coat  of  paint,  and  this 
coat  of  paint  is  not  always  refurbished  after  a  launch.  Rain 
samples  from  the  Rotating  Support  Structure  at  Launch 
Complex  39- A  in  July  1994  confirmed  that  rain  washed  the 
unprotected  primer  off  the  service  structure  and  deposited  it 
on  RCC  panels  while  the  Orbiter  sat  on  the  launch  pad.  At 
the  request  of  the  Columbia  Accident  Investigation  Board, 
rain  samples  were  again  collected  in  May  2003.  The  zinc 


Left  Wing  and  Wing  Leading  Edge 


The  Orbiter  wing  leading  edge  structural  subsystem  consists  of 
the  RCC  panels,  the  upper  and  lower  access  panels  (also  called 
carrier  panels),  and  the  associated  attachment  hardware  for  each 
of  these  components. 

On  Columbia,  t\so  upper  and  lower  A-286  stainless  steel  spar 
attachment  fittings  connected  each  RCC  panel  to  the  aluminum 
wing  leading  edge  spar.  On  later  Orbitcrs,  each  upper  and  lower 
spar  attachment  fitting  is  a  one-piece  assembly. 

The  space  between  each  RCC  panel  is  covered  by  a  gap  seal, 
also  known  as  a  T-seal.  Each  T-seal,  also  manufactured  from 
RCC.  is  attached  to  its  associated  RCC  panel  by  two  Inconel  718 
attachment  clevises.  The  upper  and  lower  carrier  panels,  which 
allow  access  behind  each  RCC  panel,  are  attached  to  the  spar  at- 
tachment fittings  after  the  RCC  panels  and  T-seals  are  installed. 
The  lower  carrier  panel  prevents  superheated  air  from  entering 
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the  RCC  panel  cavity.  A  small  space  between  the  upper  carrier 
panel  and  the  RCC  panel  allows  air  pressure  to  equalize  behind 
the  RCC  panels  during  ascent  and  re-entry. 

The  mid-wing  area  on  the  left  wing,  behind  where  the  breach 
occurred,  is  supported  by  a  series  of  trusses,  as  shown  in  red 
in  the  figure  below.  The  mid-wing  area  is  bounded  in  the  front 
and  back  by  the  Xol040  and  Xol  191  cross  spars,  respectively. 
The  numerical  designation  of  each  spar  comes  from  its  location 
along  the  Orbiter's  X-axis;  for  example,  the  Xol 040  spar  is 
1 ,040  inches  from  the  zero  point  on  the  X-axis.  The  cross  spars 
provide  the  wing's  structural  integrity.  Three  major  cross  spars 
behind  the  Xol  191  spar  provide  the  primary  structural  strength 
for  the  aft  portion  of  the  w  ing.  The  inboard  portion  of  the  mid- 
wing  is  the  outer  wall  of  the  left  wheel-well,  and  the  outboard 
portion  of  the  mid-wing  is  the  wing  leading  edge  spar,  where  the 
RCC  panels  attach. 


Xoll91 
Xol 040 


Tlie  Wing  Leading  Edge  Structural  System  on  Columbia. 


The  major  infernal  support  structures  in  the  mid-wing  ire  con- 
structed from  aluminum  alloy.  Since  aluminum  melts  at  1,200 
degrees  Fahrenheit,  it  is  likely  these  truss  tubes  in  the  mid-wing 
were  destroyed  and  wing  structural  integrity  was  lost. 
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fallout  rate  was  generally  less  than  previously  recorded 
except  for  one  location,  which  had  the  highest  rate  of  zinc 
fallout  of  all  the  samples  from  both  evaluations.  Chemical 
analysis  of  the  most  recent  rainwater  samples  determined 
the  percentage  of  zinc  to  be  consistently  around  nine  per- 
cent, with  that  one  exception. 

Specimens  with  pinholes  were  fabricated  from  RCC  panel 
12-right  and  arc -jet-tested,  but  the  arc-jet  testing  did  not 
substantially  change  the  pinhole  dimensions  or  substrate 
oxidation.  (Arc  jet  testing  is  done  in  a  wind  tunnel  with  an 
electrical  arc  that  provides  an  airflow  of  up  to  2,800  degrees 
Fahrenheit.)  As  a  result  of  the  pinhole  investigation,  the 
sealant  refurbishment  process  was  revised  to  include  clean- 
ing the  part  in  a  vacuum  at  2,000  degrees  Fahrenheit  to  bake 
out  contaminants  like  zinc  oxide  and  salt,  and  forcing  seal- 
ant into  pinholes. 

Post-flight  analysis  of  RCC  components  confirms  that  seal- 
ant is  ablated  during  each  mission,  which  increases  subsur- 
face oxidation  and  reduces  component  strength  and  mission 
life.  Based  on  the  destructive  evaluation  of  Colitnihia'^i  pan- 
el 12-right  and  various  arc -jet  tests,  refurbishment  intervals 
were  established  to  achieve  the  desired  service  life. 

In  November  2001,  white  residue  was  discovered  on  about 
half  the  RCC  panels  on  Coliimhici,  Atlantis,  and  Emleavoiir. 
Investigations  revealed  that  the  deposits  were  sodium  car- 
bonate that  resulted  from  the  exposure  of  sealant  to  rain- 
water, with  three  possible  outcomes:  ( i )  the  deposits  are 
washed  off,  which  decreases  sealant  effectiveness;  (2)  the 
deposits  remain  on  the  part's  surface,  melt  on  re-entry,  and 
combine  with  the  glass,  restoring  the  sealant  composition; 
or  (3)  the  deposits  remain  on  the  part's  surface,  melt  on  re- 
entry, and  flow  onto  metal  parts. 

The  root  cause  of  the  white  deposits  on  the  surface  of  RCC 
parts  was  the  breakdown  of  the  sealant.  This  does  not  dam- 
age RCC  material. 

Non-Destructive  Evaluations  of  Reinforced  Carbon- 
Carbon  Components 

Over  the  20  years  of  Space  Shuttle  operations,  RCC  has 
performed  extremely  well  in  the  harsh  environment  it  is 
exposed  to  during  a  mission.  Within  the  last  several  years, 
a  few  instances  of  damage  to  RCC  material  have  resulted 
in  a  re-examination  of  the  current  visual  inspection  process. 
Concerns  about  potential  oxidation  between  the  silicon 
carbide  layer  and  the  substrate  and  within  the  substrate  has 
resulted  in  further  efforts  to  develop  improved  Non-Destruc- 
tive Evaluation  methods  and  a  better  understanding  of  sub- 
surface oxidation. 

Since  1997,  inspections  have  revealed  five  instances  of 
RCC  silicon  carbide  layer  loss  with  exposed  substrate.  In 
November  1997,  Columbia  returned  from  STS-87  with  three 
damaged  RCC  parts  with  carbon  substrate  exposed.  Panel 
19-right  had  a  0.04  inch-diameter  by  0.035  inch-deep  circu- 
lar dimple,  panel  17-righl  had  a  0.1  inch-wide  by  0.2  inch- 
long  by  0.025-inch-deep  dimple,  and  the  Orbiter  forward 
External  Tank  attachment  point  had  a  0.2-inch  by  0.15-inch 


by  0.026-inch-deep  dimple.  In  January  2000,  after  STS- 103, 
Discovery'^,  panel  8-left  was  scrapped  because  of  similar 
damage  (see  Figure  3.3-5). 

In  April  2001 ,  after  STS- 102,  Columbian  panel  10-Ieft  had  a 
0. 2-inch  by  0.3-inch  wide  by  0.018-inch-deep  dimple  in  the 
panel  corner  next  to  the  T-seal.  The  dimple  was  repaired  and 
the  panel  flew  one  more  mission,  then  was  scrapped  because 
of  damage  found  in  the  repair. 


Figure  3.3-5.  RCC  panel  8-left  from  Discovery  had  to  be  scrapped 
after  STS-103  because  of  the  damage  shown  here. 


Findings: 

F3.3-I  The  original  design  specifications  required  the 
RCC  components  to  have  essentially  no  impact 
resistance. 

F3.3-2  Current  inspection  techniques  are  not  adequate 
to  assess  structural  integrity  of  the  RCC  compo- 
nents. 

F3.3-3  After  manufacturer's  acceptance  non-destructive 
evaluation,  only  periodic  visual  and  touch  tests 
are  conducted. 

F3.3-4  RCC  components  are  weakened  by  mass  loss 
caused  by  oxidation  within  the  substrate,  which 
accumulates  with  age.  The  extent  of  oxidation  is 
not  directly  measurable,  and  the  resulting  mission 
life  reduction  is  developed  analytically. 

F3.3-5  To  date,  only  two  flown  RCC  panels,  having 
achieved  15  and  19  missions,  have  been  destruc- 
tively tested  to  detennine  actual  loss  of  strength 
due  to  oxidation. 

F3.3-6  Contamination  from  zinc  leaching  from  a  primer 
under  the  paint  topcoat  on  the  launch  pad  struc- 
ture increases  the  opportunities  for  localized  oxi- 
dation. 
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Recommendations: 


R3.3- 


R3.3-2 


R3.3-3 


R3.3-4 


R3.3-5 


Develop  and  implement  a  comprehensive  in- 
spection plan  to  determine  the  structural  integ- 
rity of  all  Reinforced  Carbon-Carbon  system 
components.  This  inspection  plan  should  take 
advantage  of  advanced  non-destructive  inspec- 
tion technology. 

Initiate  a  program  designed  to  increase  the 
Orbiter's  ability  to  sustain  minor  debris  damage 
by  measures  such  as  improved  impact-resistant 
Reinforced  Carbon-Carbon  and  acreage  tiles. 
This  program  should  determine  the  actual  impact 
resistance  of  cuirent  materials  and  the  effect  of 
likely  debris  strikes. 

To  the  extent  possible,  increase  the  Orbiter's  abil- 
ity to  successfully  re-enter  the  Earth's  atmosphere 
with  minor  leading  edge  structural  sub-system 
damage. 

In  order  to  understand  the  true  material  character- 
istics of  Reinforced  Carbon-Carbon  components, 
develop  a  comprehensiv  e  database  of  flown  Rein- 
forced Carbon-Carbon  material  characteristics  by 
destructive  testing  and  evaluation. 
Improve  the  maintenance  of  launch  pad  struc- 
tures to  minimize  the  leaching  of  zinc  primer 
onto  Reinforced  Carbon-Carbon  components. 


3.4    Image  and  Transport  Analyses 

At  81.9  seconds  after  launch  of  STS-1()7,  a  sizable  piece  of 
foam  struck  the  leading  edge  o\' Coliinihia's  left  wing.  Visual 
evidence  established  the  source  of  the  foam  as  the  left  bipod 
ramp  area  of  the  External  Tank.  The  widely  accepted  im- 
plausibility  of  foam  causing  significant  damage  to  the  wing 
leading  edge  sy.stem  led  the  Board  to  conduct  independent 
tests  to  characterize  the  impact.  While  it  was  impossible  to 
determine  the  precise  impact  parameters  because  of  uncer- 
tainties about  the  foam's  density,  dimensions,  shape,  and 
initial  velocity,  intensive  work  by  the  Board,  NASA,  and 
contractors  provided  credible  ranges  for  these  elements.  The 


Figure  3.4-?  (color  enhanced  and  "de-blurred"  by  Lockheed  Mar- 
tin Gaithersburg)  and  Figure  3.4-2  (processed  by  the  National 
Imagery  and  Mapping  Agency)  are  samples  of  the  type  of  visual 
data  used  to  establish  the  time  of  the  impact  (87.9  seconds),  the 
altitude  at  which  it  occurred  (65,860  feefj,  and  the  object's  rela- 
tive velocity  at  impact  (about  545  mph  relative  to  the  Orbiter). 


Board  used  a  combination  of  tests  and  analyses  to  conclude 
that  the  foam  strike  observed  during  the  flight  of  STS-107 
was  the  direct,  physical  cause  of  the  accident. 

Image  Analysis:  Establishing  Size,  Velocity,  Origin, 
and  Impact  Area 

The  investigation  image  analysis  team  included  members 
from  Johnson  Space  Center  Image  Analysis.  Johnson  Space 
Center  Engineering.  Kennedy  Space  Center  Photo  Analysis, 
Marshall  Space  Flight  Center  Photo  Analysis,  Lockheed 
Martin  Management  and  Data  Systems,  the  National  Im- 
agery and  Mapping  Agency.  Boeing  Systems  Integration, 
and  Langley  Research  Center.  Each  member  of  the  image 
analysis  team  performed  independent  analyses  using  tools 
and  methods  of  their  own  choosing.  Representatives  of  the 
Board  participated  regularly  in  the  meetings  and  delibera- 
tions of  the  image  analysis  team. 

A  35-mm  film  camera,  E212.  which  recorded  the  foam 
strike  from  17  miles  away,  and  video  camera  E208.  which 
recorded  it  from  26  miles  away,  provided  the  best  of  the 
available  evidence.  Analysis  of  this  visual  evidence  (see 
Figures  3.4-1  and  3.4-2)  along  with  computer-aided  design 
analysis,  refined  the  potential  impact  area  to  less  than  20 
square  feet  in  RCC  panels  6  through  9  (see  Figure  3.4-3), 
including  a  portion  of  the  corresponding  carrier  panels  and 
adjacent  tiles.  The  investigation  image  analysis  team  found 
no  conclusive  visual  evidence  of  post-impact  debris  flowing 
over  the  top  of  the  wing. 


Figure  3.4-3:  The  best  estimate  of  the  site  of  impact  by  the  center 
of  the  foam. 


The  image  analysis  team  established  impact  velocities  from 
625  to  840  feet  per  second  (about  400  to  600  mph)  relative  to 
the  Orbiter.  and  foam  dimensions  from  2!  to  27  inches  long 
by  1 2  to  1 8  inches  wide."  The  wide  range  for  these  measure- 
ments is  due  primarily  to  the  cameras'  relatively  slow  frame 
rate  and  poor  resolution.  For  example,  a  20-inch  change  in 
the  position  of  the  foam  near  the  impact  point  world  change 
the  estimated  relative  impact  speed  from  675  feet  per  second 
to  825  feet  per  second.  The  visual  evidence  could  not  reveal 
the  foam's  shape,  but  the  team  was  able  to  describe  it  as  flat 
and  relatively  thin.  The  mass  and  hence  the  volume  of  the 
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foam  was  determined  from  the  velocity  estimates  and  their 
ballistic  coefficients. 

Image  analysis  determined  that  the  foam  was  moving  almost 
parallel  to  the  Orbiter's  fuselage  at  impact,  with  about  a 
five-degree  angle  upward  toward  the  bottom  of  the  wing  and 
slight  motion  in  the  outboard  direction.  If  the  foam  had  hit 
the  tiles  adjacent  to  the  leading  edge,  the  angle  of  incidence 
would  have  been  about  five  degrees  (the  angle  of  incidence 
is  the  angle  between  the  relative  velocity  of  the  projectile  and 
the  plane  of  the  impacted  surface).  Because  the  wing  leading 
edge  curves,  the  angle  of  incidence  increases  as  the  point  of 
impact  approaches  the  apex  of  an  RCC  panel.  Image  and 
transport  analyses  estimated  that  for  impact  on  RCC  panel 
8,  the  angle  of  incidence  was  between  10  and  20  degrees 
(see  Figure  3.4-4).''  Because  the  total  force  delivered  by  the 
impact  depends  on  the  angle  of  incidence,  a  foam  strike  near 
the  apex  of  an  RCC  panel  could  have  delivered  about  twice 
the  force  as  an  impact  close  to  the  base  of  the  panel. 

Despite  the  uncertainties  and  potential  errors  in  the  data,  the 
Board  concurred  with  conclusions  made  unanimously  by  the 
post-flight  image  analysis  team  and  concludes  the  informa- 
tion available  about  the  foam  impact  during  the  mission  was 
adequate  to  determine  its  effect  on  both  the  thermal  tiles  and 
RCC.  Those  conclusions  made  during  the  mission  follow: 

•  The  bipod  ramp  was  the  source  of  the  foam. 

•  Multiple  pieces  of  foam  were  generated,  but  there  was 
no  evidence  of  more  than  one  strike  to  the  Orbiter. 

•  The  center  of  the  foam  struck  the  leading  edge  structural 
subsystem  of  the  left  wing  between  panels  6  to  9.  The 
potential  impact  location  included  the  corresponding 
carrier  panels,  T-seals,  and  adjacent  tiles.  (Based  on  fur- 
ther image  analysis  performed  by  the  National  Imagei^ 
and  Mapping  Agency,  the  transport  analysis  that  fol- 
lows, and  forensic  evidence,  the  Board  concluded  that  a 
smaller  estimated  impact  area  in  the  immediate  vicinity 
of  panel  8  was  credible.) 

•  Estimates  of  the  impact  location  and  velocities  rely  on 
timing  of  camera  images  and  foam  position  measure- 
ments. 

•  The  relative  velocity  of  the  foam  at  impact  was  625  to 
840  feet  per  second.  (The  Board  agreed  on  a  narrower 
speed  range  based  on  a  transport  analysis  that  follows.) 

•  The  trajectoi7  of  the  foam  at  impact  was  essentially 
parallel  to  the  Orbiter's  fuselage. 

•  The  foam  was  making  about  18  revolutions  per  second 
as  it  fell. 

•  The  orientation  at  impact  could  not  be  determined. 

•  The  foam  that  struck  the  wing  was  24  (plus  or  minus  3) 
inches  by  15  (plus  or  minus  3)  inches.  The  foam  shape 
could  only  be  described  as  flat.  (A  subsequent  transport 
analysis  estimated  a  thickness.) 

•  Ice  was  not  present  on  the  external  surface  of  the  bipod 
ramp  during  the  last  Ice  Team  camera  scan  prior  to 
launch  (at  approximately  T-5  minutes). 

•  There  was  no  visual  evidence  of  the  presence  of  other 
materials  inside  the  bipod  ramp. 

.   •  The  foam  impact  generated  a  cloud  of  pulverized  debris 
with  very  little  component  of  velocity  away  from  the 


Possible 
Foam  ' 
trajectory 

Possible 
Foam  - 
trajectory 


angle  of  incidence 


Figure  3.4-4.  This  drawing  shows  fhe  curve  of  the  wing  leading 
edge  and  illustrates  the  difference  the  angle  of  incidence  has  on 
the  effect  of  the  foam  strike. 


•  In  addition,  the  visual  evidence  showed  two  sizable, 
traceable  post-strike  debris  pieces  with  a  significant 
component  of  velocity  away  from  the  wing. 

Although  the  investigation  image  analysis  team  found  no 
evidence  of  post-strike  debris  going  over  the  top  of  the 
wing  before  or  after  impact,  a  colorimetric  analysis  by 
the  National  Imagery  and  Mapping  Agency  indicated  the 
potential  presence  of  debris  material  over  the  top  of  the  left 
wing  immediately  following  the  foam  strike.  This  analysis 
suggests  that  some  of  the  foam  may  have  struck  closer  to  the 
apex  of  the  wing  than  what  occurred  during  the  impact  tests 
described  below. 

Imaging  Issues 

The  image  analysis  was  hampered  by  the  lack  of  high  reso- 
lution and  high  speed  ground-based  cameras.  The  existing 
camera  locations  are  a  legacy  of  earlier  NASA  programs, 
and  are  not  optimum  for  the  high-inclination  Space  Shuttle 
missions  to  the  International  Space  Station  and  oftentimes 


The  Orbiter  "Ran  Into"  the  Foam  ^  ^ 

"How  could  a  lightweight  piece  of  foam  travel  so  fast  and  hit 
the  wing  at  545  miles  per  hour?"" 

Just  prior  to  separating  from  the  External  Tank,  the  foam  was 
traveling  with  the  Shuttle  stack  at  about  I.56S  mph  (2,.^00 
feet  per  second).  Visual  evidence  shows  that  the  foam  de- 
bris impacted  the  wing  approximately  0.161  seconds  after 
separating  from  the  External  Tank.  In  that  lime,  the  velocity 
of  the  foam  debris  slowed  from  1,568  mph  to  about  1,022 
mph  (1,500  feet  per  second).  Therefore,  the  Orbiter  hit  the 
foam  with  a  relative  velocity  of  about  545  mph  (800  feet  per 
second).  In  essence,  the  foam  debris  slowed  down  and  the 
Orbiter  did  not,  so  the  Orbiter  ran  into  the  foam.  The  foam 
slowed  down  rapidly  because  such  low-density  objects  have 
low  ballistic  coefficients,  which  means  their  speed  rapidly 
decreases  when  they  lose  their  means  of  propulsion. 
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During  STS-107 
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654 

All 

400 

1,920 

1,200 

After  STS- 107 

528 

559 

528 

1,026 

1,239 
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Figure  3.4-5.  The  best  estimates  of  velocities  and  volumes  calculated  during  the  mission  and  after  the  accident  based  on  visual  evidence  and 
computer  analyses.  Information  available  during  the  miss/on  was  adequate  to  determine  the  foam's  effect  on  both  thermal  tiles  and  RCC. 


cameras  are  not  operating  or.  as  in  the  case  of  STS-107,  out 
of  focus.  Launch  Commit  Criteria  should  include  that  suf- 
ficient cameras  are  operating  to  track  the  Shuttle  from  liftoff 
to  Solid  Rocket  Booster  separation. 

Similarly,  a  developmental  vehicle  like  the  Shuttle  should  be 
equipped  w  ith  high  resolution  cameras  that  monitor  potential 
hazard  areas.  The  wing  leading  edge  system,  the  area  around 
the  landing  gear  doors,  and  other  critical  Themial  Protection 
System  eleinents  need  to  be  imaged  to  check  for  damage. 
Debris  sources,  such  as  the  External  Tank,  also  need  to  be 
monitored.  Such  critical  images  need  to  be  downlinked  so 
that  potential  problems  are  identified  as  soon  as  possible. 

Transport  Analysis:  Establishing  Foam  Path 
by  Computational  Fluid  Dynamics 

Transport  analysis  is  the  process  of  determining  the  path  of 
the  foam.  To  refine  the  Board's  understanding  of  the  foam 
strike,  a  transport  analysis  team,  consisting  of  members 
from  Johnson  Space  Center,  Ames  Research  Center,  and 
Boeing,  augmented  the  image  analysis  team's  research. 

A  variety  of  computer  models  were  used  to  estimate  the  vol- 
ume of  the  foam,  as  well  as  to  refine  the  estimates  of  its  ve- 
locity, its  other  dimensions,  and  the  impact  location.  Figure 
3.4-5  lists  the  velocity  and  foam  size  estimates  produced  dur- 
ing the  mission  and  at  the  conclusion  of  the  investigation. 

The  results  listed  in  Figure  .^.4-3  demonstrate  that  reason- 
ably accurate  estimates  of  the  foam  size  and  impact  velocity 
were  available  during  the  mission.  Despite  the  lack  of  high- 
quality  visual  evidence,  the  input  data  available  to  assess  the 
impact  damage  during  the  mission  was  adequate. 

The  input  data  to  the  transport  analysis  consisted  of  the  com- 
puted airflow  around  the  Shuttle  stack  when  the  foam  was 
shed,  the  estimated  aerodynamic  characteristics  of  the  foam, 
the  image  analysis  team's  trajectory  estimates,  and  the  size 
and  shape  of  the  bipod  ramp. 

The  transport  analysis  team  screened  several  of  the  image 
analysis  team's  location  estimates,  based  on  the  feasible 
aerodynamic  characteristics  of  the  foam  and  the  laws  of 
physics.  Optical  distortions  caused  by  the  atmospheric  den- 
sity gradients  associated  with  the  shock  waves  off  the  Or- 
biter's  nose.  External  Tank,  and  Solid  Rocket  Boosters  may 
have  compromised  the  image  analysis  team's  three  position 
estimates  closest  to  the  bipod  ramp.  In  addition,  the  image 
analysis  team's  position  estimates  closest  to  the  wing  were 
compromised  by  the  lack  of  two  camera  views  and  the  shock 


region  ahead  of  the  wing,  making  triangulation  impossible 
and  requiring  extrapolation.  However,  the  transport  analysis 
confinned  that  the  image  analysis  team's  estimates  for  the 
central  portion  of  the  foam  trajectory  were  well  within  the 
computed  flow  field  and  the  estimated  range  of  aerodynamic 
characteristics  of  the  foam. 

The  team  identified  a  relatively  narrow  range  of  foam  im- 
pact velocities  and  ballistic  coefficients.  The  ballistic  coef- 
ficient of  an  object  expresses  the  relative  influence  of  weight 
and  atmospheric  drag  on  it,  and  is  the  primary  aerodynamic 
characteristic  of  an  object  that  does  not  produce  lift.  An 
object  with  a  large  ballistic  coefficient,  such  as  a  cannon 
ball,  has  a  trajectory  that  can  be  computed  fairly  accurately 
without  accounting  for  drag.  In  contrast,  the  foam  that  struck 
the  wing  had  a  relatively  small  ballistic  coefficient  with  a 
large  drag  force  relative  to  its  weight,  which  explains  why 
it  slowed  down  quickly  after  separating  from  the  External 
Tank.  Just  prior  to  separation,  the  speed  of  the  foam  was 
equal  to  the  speed  of  the  Shuttle,  about  1,568  mph  (2.300 
feet  per  second).  Because  of  a  large  drag  force,  the  foam 
slowed  to  about  1 ,022  mph  ( 1 ,500  feet  per  second)  in  about 
0.2  seconds,  and  the  Shuttle  struck  the  foam  at  a  relative 


Figure  3.4-6.  These  are  the  results  of  a  trajectory  analysis  that 
used  a  computational  fluid  dynamics  approach  in  a  program 
called  CART-3D,  a  comprehensive  (six-degree-of-freedom)  com- 
puter simulation  based  on  the  laws  of  physics.  This  analysis  used 
the  aerodynamic  and  mass  properties  of  bipod  ramp  foam, 
coupled  with  the  complex  flow  Field  during  ascent,  to  determine 
the  likely  position  and  velocity  histories  of  the  foam. 
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Figure  3.4-7,  The  results  of  numerous  possible  fro/ecfories  based 
on  various  ossumed  sizes,  sfiopes,  and  densifies  of  ffie  foam. 
Either  the  foam  had  a  slightly  higher  ballistic  coefficienf  and  the 
Orbifer  struck  the  foam  at  a  lower  speed  relative  to  the  Orbiter, 
or  the  foam  was  more  compact  and  the  wing  struck  the  foam  at  a 
higher  speed.  The  "best  fit"  box  represents  the  overlay  of  the  data 
from  the  impge  analysis  with  the  transport  <inalysis  computations. 
This  data  enabled  a  Final  selection  of  projectile  characteristics  for 
impact  testing. 


speed  of  about  545  mph  (800  feet  per  second).  (See  Ap- 
pendix D.8.) 

The  undetermined  and  yet  certainly  inegular  shape  of  the 
foam  introduced  substantial  uncertainty  about  its  estimated 
aerodynamic  characteristics.  Appendix  D.8  contains  an  in- 
dependent analysis  conducted  by  the  Board  to  confirm  that 
the  estimated  range  of  ballistic  coefficients  of  the  foam  in 
Figure  3.4-6  was  credible,  given  the  foam  dimension  results 
from  the  image  analyses  and  the  expected  range  of  the  foam 
density.  Based  on  the  results  in  Figure  3.4-7,  the  physical 
dimensions  of  the  bipod  ramp,  and  the  sizes  and  shapes 
of  the  available  barrels  for  the  compressed-gas  gun  used 
in  the  impact  test  program  described  later  in  this  chapter, 
the  Board  and  the  NASA  Accident  Investigation  Team  de- 
cided that  a  foam  projectile  19  inches  by  1 1.5  inches  by  5.5 
inches,  weighing  1 .67  pounds,  and  with  a  weight  density  of 
2.4  pounds  per  cubic  foot,  would  best  represent  the  piece  of 
foam  that  separated  from  the  External  Tank  bipod  ramp  and 
was  hit  by  the  Orbiter's  left  wing.  See  Section  3.8  for  a  full 
discussion  of  the  foam  impact  testing. 


Findings: 

F3.4-1  Photographic  evidence  during  ascent  indicates 
the  projectile  that  stmck  the  Orbiter  was  the  left 
bipod  ramp  foam. 

F3.4-2  The  same  photographic  evidence,  confirmed  by 
independent  analysis,  indicates  the  projectile 
struck  the  underside  of  the  leading  edge  of  the 
left  wing  in  the  vicinity  of  RCC  panels  6  through 
9  or  the  tiles  directly  behind,  with  a  velocity  of 
approximately  775  feet  per  second. 

F3.4-3        There  is  a  requirement  to  obtain  and  downlink 


on-board  engineering  quality  imaging  from  the 
Shuttle  during  launch  and  ascent. 

F3.4-4  The  current  long-range  camera  assets  on  the  Ken- 
nedy Space  Center  and  Eastern  Range  do  not  pro- 
vide best  possible  engineering  data  during  Space 
Shuttle  a.scents. 

F3.4-5  Evaluation  of  STS-107  debris  impact  was  ham- 
pered by  lack  of  high  resolution,  high  speed  cam- 
eras (temporal  and  spatial  imagery  data). 

F3.4-6  Despite  the  lack  of  high  quality  visual  evidence, 
the  information  available  about  the  foam  impact 
during  the  mission  was  adequate  to  determine  its 
effect  on  both  the  thermal  tiles  and  RCC. 

Recommendations: 

R3.4-1  Upgrade  the  imaging  system  to  be  capable  of 
providing  a  minimum  of  three  useful  views  of  the 
Space  Shuttle  from  liftoff  to  at  least  Solid  Rocket 
Booster  separation,  along  any  expected  ascent 
azimuth.  The  operational  status  of  these  assets 
should  be  included  in  the  Launch  Commit  Cri- 
teria for  future  launches.  Consider  using  ships  or 
aircraft  to  provide  additional  views  of  the  Shuttle 
during  ascent. 

R3.4-2  Provide  a  capability  to  obtain  and  downlink  high- 
resolution  images  of  the  External  Tank  after  it 
separates. 

R3.4-3  Provide  a  capability  to  obtain  and  downlink  high- 
resolution  images  of  the  underside  of  the  Orbiter 
wing  leading  edge  and  forward  section  of  both 
wings"  Thermal  Protection  System. 

3.5    On-Orbit  Debris  Separation  - 
The  "Flight  Day  2"  Object 

Immediately  after  the  accident.  Air  Force  Space  Command 
began  an  in-depth  review  of  its  Space  Surveillance  Network 
data  to  determine  if  there  were  any  detectable  anomalies 
during  the  STS-107  mission.  A  review  of  the  data  resulted  in 
no  information  regarding  damage  to  the  Orbiter.  However, 
Air  Force  processing  of  Space  Surveillance  Network  data 
yielded  3,180  separate  radar  or  optical  observations  of  the 
Orbiter  from  radar  sites  at  Eglin,  Beale,  and  Kirtland  Air 
Force  Bases.  Cape  Cod  Air  Force  Station,  the  Air  Force 
Space  Command's  Maui  Space  Surveillance  System  in 
Hawaii,  and  the  Navy  Space  Surveillance  System.  These 
observations,  examined  after  the  accident,  showed  a  small 
object  in  orbit  with  Columbia.  In  accordance  with  the  In- 
ternational Designator  system,  the  object  was  named  2003- 
003B  (Columbia  was  designated  2003-003A).  The  timeline 
of  significant  events  includes: 

1.  January  17,  2(X)3,  9:42  a.m.  Eastern  Standard  Time: 
Orbiter  moves  from  tail-first  to  right-wing-first  orien- 
tation 

2.  January  17,  10:17  a.m.:  Orbiter  returns  to  tail-first 
orientation 

3.  Januai7  17,  3:57  p.m.:  First  confirmed  sensor  track  of 
object  2003-003B 

4.  January  1 7,  4:46  p.m.:  Last  confirmed  sensor  track  for 
this  date 


Report    Volume     I 


COLUMBIA 

ACCIDENT  INVESTIGATION  BOARD 


5.  Januan'  18:  Object  reacquired  and  tracked  by  Cape 
Cod  Air  Force  Station  PAVE  PAWS 

6.  Januarv'  19;  Object  reacquired  and  tracked  by  Space 
Surveillance  Network 

7.  January  20.  8:45  -  1 1 :45  p.m.:  2003-0038  orbit  de- 
cays. Last  track  by  Navy  Space  Surveillance  System 

Events  around  the  estimated  separation  time  of  the  object 
were  reviewed  in  great  detail.  Extensive  on-board  sensor 
data  indicates  that  no  unusual  crew  activities,  telemetiy 
data,  or  accelerations  in  Orbiter  or  payload  can  account  for 
the  release  of  an  object.  No  external  mechanical  systems 
were  active,  nor  were  any  translational  (forward,  backward, 
or  sideways,  as  opposed  to  rotational)  maneuvers  attempted 
in  this  period.  However,  two  attitude  maneuvers  were  made: 
a  48-degree  yaw  maneuver  to  a  left-wing-forward  and  pay- 
load-bay-to-Earth  attitude  from  9:42  to  9:46  a.m.  EST),  and 

On-Orbit  Collision  Avoidance 

The  Space  Control  Center,  operated  by  the  2 1st  Space  Wing's 
1st  Space  Control  Squadron  (a  unit  of  Air  Force  Space  Com- 
mand), maintains  an  orbital  data  catalog  on  some  9.0()() 
Earth-orbiting  objects,  from  active  satellites  to  space  debris, 
some  of  which  may  be  as  small  as  four  inches.  The  Space 
Control  Center  ensures  that  no  known  orbiting  objects  will 
transit  an  Orbiter  "safety  zone'"  measuring  6  miles  deep  by 
25  miles  wide  and  long  (Figure  A)  during  a  Shuttle  mission 
by  projecting  the  Orbiter"s  flight  path  for  the  next  72  hours 
(Figure  B)  and  comparing  it  to  the  flight  paths  of  all  known 
orbiting  or  re-entering  objects,  which  generally  travel  at 
17.500  miles  per  hour  Whenever  possible,  the  Orbiter  moves 
tail-first  while  on  orbit  to  minimize  the  chances  of  orbital 
debris  or  micrometeoroids  impacting  the  cabin  windscreen  or 
the  Orbiter's  wing  leading  edae. 


a  maneuver  back  to  the  bay-to-Earth,  tail-forward  attitude 
from  10:17  to  10:21  a.m.  It  is  possible  that  this  maneuver 
imparted  the  initial  departure  velocity  to  the  object. 

Although  various  Space  Surveillance  Network  radars 
tracked  the  object,  the  only  reliable  physical  information 
includes  the  object's  ballistic  coefficient  in  kilograms  per 
square  meter  and  its  radar  cross-section  in  decibels  per 
square  meter.  An  object's  radar  cross-section  relates  how 
much  radar  energy  the  object  scatters.  Since  radar  cross- 
.section  depends  on  the  object's  material  properties,  shape, 
and  orientation  relative  to  the  radar,  the  Space  Surveillance 
Network  could  not  independently  estimate  the  object's  size 
or  shape.  By  radar  observation,  the  object's  Ultra-High 
Frequency  (UHF)  radar  cross-section  varied  between  0.0 
and  minus  18.0  decibels  per  square  meter  (plus  or  minus 
1.3  decibels),  and  its  ballistic  coefficient  was  known  to  be 
0.1  kilogram  per  meter  .squared  (plus  or  minus  15  percent). 
These  two  quantities  were  used  to  test  and  ultimately  elimi- 
nate various  objects. 


RCC  Panel  Fragment  2018 

(From  STS.107  Right  Wing 

panel  #10) 


RCC  Panel  Fragment  37736 

(From  STS.107  Right  Wing 

panel  #10) 


If  an  object  is  determined  to  be 
within  .'^6-72  hours  of  collid- 
ing with  the  Orbiter.  the  Space 
Control  Center  notifies  NASA. 
and  the  agency  then  determines 
a  maneuver  to  avoid  a  collision. 
There  were  no  close  apprt)ach- 
es  to  Columbia  detected  during 
STS-107. 

Figure  A    Orbifer  Safety  Zone 


Figure  6.  Protecting  the  Orbifer's  flight  path 


Figure  3.5-].  These  represenfofive  RCC  ocreage  pieces  matched 
the  radar  cross-section  of  the  Flight  Day  2  object. 


In  the  Advanced  Compact  Range  at  the  Air  Force  Research 
Laboratory  in  Dayton,  Ohio,  analysts  tested  31  materials 
from  the  Orbiter's  exterior  and  payload  bay.  Additional 
supercomputer  radar  cross-section  predictions  were  made 
for  Reinforced  Carbon-Carbon  T-seals.  After  exhaustive 
radar  cross-section  analysis  and  testing,  coupled  with  bal- 
listic analysis  of  the  object's  orbital  decay,  only  a  fragment 
of  RCC  panel  would  match  the  UHF  radar  cross-section 
and  ballistic  coefficients  observed  by  the  Space  Surveil- 
lance network.  Such  an  RCC  panel  fragment  must  be  ap- 
proximately 140  square  inches  or  greater  in  area  to  meet  the 
observed  radar  cross-section  characteristics.  Figure  3.5-1 
shows  RCC  panel  fragments  from  Coliimhici's  right  wing 
that  represent  those  meeting  the  observed  characteristics  of 
object  2003-003B.'" 

Note  that  the  Southwest  Research  Institute  foam  impact  test 
on  panel  8  (see  Section  3.8)  created  RCC  fragments  that  fell 
into  the  wing  cavity.  These  pieces  are  consistent  in  size  with 
the  RCC  panel  fragments  that  exhibited  the  required  physi- 
cal characteristics  consistent  with  the  Flight  Day  2  object. 
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Findings: 

F3.5-1  The  object  seen  on  orbit  with  Colitmhiu  on  Flight 
Day  2  through  4  matches  the  radar  cross-section 
and  area-to-mass  measurements  of  an  RCC  panel 
fragment. 

F3.5-2  Though  the  Board  could  not  positively  identify 
the  Flight  Day  2  object,  the  U.S.  Air  Force  ex- 
clusionary test  and  analysis  processes  reduced 
the  potential  Flight  Day  2  candidates  to  an  RCC 
panel  fragment. 

Recommendations: 

•  None 

3.6    De-Orbit/Re-Entry 

As  Columbia  re-entered  Earth's  atmosphere,  sensors  in  the 
Orbiter  relayed  streams  of  data  both  to  entry  controllers  on 
the  ground  at  .lohn.son  Space  Center  and  to  the  Modular 
Auxiliai7  Data  System  recorder,  which  survived  the  breakup 
of  the  Orbiter  and  was  recovered  by  ground  search  teams. 
This  data  -  temperatures,  pressures,  and  stresses  -  came 
from  sensors  located  throughout  the  Orbiter.  Entry  control- 
lers were  unaware  of  any  problems  with  re-enti-y  until  telem- 
etry data  indicated  errant  readings.  During  the  investigation 
data  from  these  two  sources  was  used  to  make  aerodynamic, 
aerothermal,  and  mechanical  reconstructions  of  re-entry  that 
showed  how  these  stresses  affected  the  Orbiter. 

The  re-entry  analysis  and  testing  focused  on  eight  areas: 

1 .  Analysis  of  the  Modular  Auxiliaiy  Data  System  re- 
corder information  and  the  pattern  of  wire  runs  and 
sensor  failures  throughout  the  Orbiter. 

2.  Physical  and  chemical  analysis  of  the  recovered  de- 
,bris  to  determine  where  the  breach  in  the  RCC  panels 

likely  occurred. 

3.  Analysis  of  videos  and  photography  provided  by  the 
general  public. 

4.  Abnormal  heating  on  the  outside  of  the  Orbiter  body. 
Sensors  showed  lower  heating  and  then  higher  heating 
than  is  usually  seen  on  the  left  Orbital  Maneuvering 
System  pod  and  the  left  side  of  the  fuselage. 

5.  Early  heating  inside  the  wing  leading  edge.  Initially, 
heating  occurred  inside  the  left  wing  RCC  panels  be- 
fore the  wing  leading  edge  spar  was  breached. 

6.  Later  heating  inside  the  left  wing  structure.  This  analy- 
sis focused  on  the  inside  of  the  left  wing  after  the  wing 
leading  edge  spar  had  been  breached. 

7.  Early  changes  in  aerodynamic  performance.  The  Or- 
biter began  reacting  to  increasing  left  yaw  and  left  roll, 
consistent  with  developing  drag  and  loss  of  lift  on  the 
left  wing. 

8.  Later  changes  in  aerodynamic  performance.  Almost 
6()0  seconds  after  Entry  Inteiface,  the  left-rolling  ten- 
dency of  the  Orbiter  changes  to  a  right  roll,  indicating 
an  increase  in  lift  on  the  left  wing.  The  left  yaw  also 
increased,  showing  increasing  drag  on  the  left  wing. 

For  a  complete  compilation  of  all  re-entry  data,  see  the 
CAIB/NAIT  Working  Scenario  (Appendix  D.7),  Qualification 


and  Interpretation  of  Sensor  Data  from  STS- 107  (Appendix 
D.  19)  and  the  Re-entry  Timeline  (Appendix  D.9).  The 
extensive  aerothermal  calculations  and  wind  tunnel  tests 
performed  to  investigate  the  observed  re-entry  phenomenon 
are   documented    in  NASA  report  NSTS-37398. 

Re-Entry  Environment 

In  the  demanding  environment  of  re-entry,  the  Orbiter  must 
withstand  the  high  temperatures  generated  by  its  movement 
through  the  increasingly  dense  atmosphere  as  it  deceler- 
ates from  orbital  speeds  to  land  safely.  At  these  velocities, 
shock  waves  form  at  the  nose  and  along  the  leading  edges 
of  the  wing,  intersecting  near  RCC  panel  9.  The  interac- 
tion between  these  two  shock  waves  generates  extremely 
high  temperatures,  especially  around  RCC  panel  9.  which 
experiences  the  highest  surface  temperatures  of  all  the  RCC 
panels.  The  flow  behind  these  shock  waves  is  at  such  a  high 
temperature  that  air  molecules  are  torn  apart,  or  "dissoci- 
ated." The  air  immediately  around  the  leading  edge  surface 
can  reach  1 0,000  degrees  Fahrenheit;  however,  the  boundary 
layer  shields  the  Orbiter  so  that  the  actual  temperature  is  only 
approximately  3,000  degrees  Fahrenheit  at  the  leading  edge. 
The  RCC  panels  and  internal  insulation  protect  the  alumi- 
num wing  leading  edge  spar.  A  breach  in  one  of  the  leading- 
edge  RCC  panels  would  expose  the  internal  wing  structure 
to  temperatures  well  above  3,000  degrees  Fahrenheit. 

In  contrast  to  the  aerothermal  environment,  the  aerodynamic 
environment  during  ColiinihUfs  re-entry  was  relatively  be- 
nign, especially  early  in  re-entry.  The  re-entry  dynamic  pres- 
sure ranged  from  zero  at  Entry  Interface  to  80  pounds  per 
square  foot  when  the  Orbiter  went  out  of  control,  compared 
with  a  dynamic  pressure  during  laimch  and  ascent  of  nearly 
700  pounds  per  square  foot.  H(Hvever,  the  aerodynamic 
forces  were  increasing  quickly  during  the  final  minutes  of 
Columbia  ?•  flight,  and  played  an  important  role  in  the  loss 
of  control. 

Orbiter  Sensors 

The  Operational  Flight  Instrumentation  monitors  physical 
sensors  and  logic  signals  that  report  the  status  of  various 
Orbiter  functions.  These  sensor  readings  and  signals  are 
telemetered  via  a  128  kilobit-per-second  data  stream  to  the 
Mission  Control  Center,  where  engineers  ascertain  the  real- 
time health  of  key  Orbiter  systems.  An  extensive  review  of 
this  data  has  been  key  to  understanding  what  happened  to 
STS- 107  during  ascent,  orbit,  and  re-entry. 

The  Modular  Auxiliary  Data  System  is  a  supplemental 
instrumentation  system  that  gathers  Orbiter  data  for  pro- 
cessing after  the  mission  is  completed.  Inputs  are  almost 
exclusively  physical  sensor  readings  of  temperatures,  pres- 
sures, mechanical  strains,  accelerations,  and  vibrations.  The 
Modular  Auxiliary  Data  System  usually  records  only  the 
mission's  first  and  last  two  hours  (see  Figure  3.6-1 ). 

The  Orbiter  Experiment  instrumentation  is  an  expanded 
suite  of  sensors  for  the  Modular  Auxiliary  Data  System  that 
was  installed  on  Columbia  for  engineering  development 
purposes.  Because  Columbia  was  the  first  Orbiter  launched. 
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Figure  3.6-?.  The  Modular  Auxiliary  Data  System  recorder,  found 
near  Hemphill,  Texas.  While  not  designed  to  withsfand  impact 
damage,  the  recorder  was  in  near-perfect  condition  when  recov- 
ered on  March  19,  2003. 


engineering  teams  needed  a  means  to  gather  more  detailed 
flight  data  to  validate  their  calculations  of  conditions  the 
vehicle  would  experience  during  critical  flight  phases.  The 
instrumentation  remained  on  Cohiinhia  as  a  legacy  of  the 
development  process,  and  was  still  providing  valuable  flight 
data  from  ascent,  de-orbit,  and  re-entry  for  ongoing  flight 
analysis  and  vehicle  engineering.  Nearly  all  of  Columbia's 
sensors  were  specified  to  have  only  a  10-year  shelf  life,  and 
in  some  cases  an  even  shorter  .service  life. 

At  22  years  old,  the  majority  of  the  Orbiter  Experiment  in- 
strumentation had  been  in  service  twice  as  long  as  its  speci- 
fied service  life,  and  in  fact,  many  sensors  were  already  fail- 
ing. Engineers  planned  to  stop  collecting  and  analyzing  data 
once  most  of  the  sensors  had  failed,  so  failed  sensors  and 
wiring  were  not  repaired.  For  instance,  of  the  181  sensors  in 
Coh(inhici\  wings,  55  had  already  failed  or  were  producing 
questionable  readings  before  STS-107  was  launched. 

Re-Entry  Timeline 

Times  in  the  following  section  are  noted  in  seconds  elapsed 
from  the  time  Colimihiu  crossed  Entry  interface  (El)  over 
the  Pacific  Ocean  at  8:44:09  a.m.  EST.  Cohiinhia  ■a  destruc- 
tion occurred  in  the  period  from  Entry  interface  at  400,000 
feet  (Ei-HOOO)  to  about  200,000  feet  (Ei-i-970)  over  Texas. 
The  Modular  Auxiliary  Data  System  recorded  the  first 
indications  of  problems  at  EI  plus  270  seconds  (Ei-H270). 
Because  data  from  this  system  is  retained  onboard,  Mission 
Control  did  not  notice  any  troubling  indications  from  telem- 
etry data  until  8:34:24  a.m.  (Ei-i-613),  some  10  minutes  after 
Entry  Interface. 

Left  Wing  Leading  Edge  Spar  Breach 
(EI+270  through  EI+515) 

At  EI-t-270,  the  Modular  Auxiliary  Data  System  recorded 
the  first  unusual  condition  while  the  Orbiter  was  still  over 
the  Pacific  Ocean.  Four  sensors,  which  were  all  either  inside 


Figure  3.6-2.  tocafion  of  sensors  on  the  back  of  the  left  wing  lead- 
ing edge  spar  (vertical  aluminum  structure  in  picture).  Also  shown 
are  the  round  truss  tubes  ond  ribs  that  provided  the  structural 
support  for  the  mid-wing  in  this  area. 


or  outside  the  wing  leading  edge  spar  near  Reinforced  Car- 
bon-Carbon (RCC)  panel  9-left,  helped  tell  the  story  of  what 
happened  on  the  left  wing  of  the  Orbiter  early  in  the  re-entry. 
These  four  sensors  were:  strain  gauge  VI2G992IA  (Sensor 
I ),  resistance  temperature  detector  V09T99I0A  on  the  RCC 
clevis  between  panel  9  and  10  (Sensor  2),  thermocouple 
V07T9666A,  within  a  Thermal  Protection  System  tile  (Sen- 
sor 3),  and  resistance  temperature  detector  V09T9895A 
(Sensor  4),  located  on  the  back  side  of  the  wing  leading  edge 
spar  behind  RCC  panels  8  and  9  (see  Figure  3.6-2). 
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Figure  3.6-3.  The  strain  gauge  (Sensor  1)  on  the  back  of  the  left 
wing  leading  edge  spar  was  the  First  sensor  fo  show  on  anomalous 
reading.  In  this  chart,  and  the  others  that  follow,  the  red  line  indi- 
cates data  from  STS-T07.  Data  from  other  Columbia  re-enfries,  simi- 
lar to  the  STS-107  re-entry  profile,  are  shown  in  the  other  colors. 
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V07T9910A  -  Left  Wing  Leading  Edge  Spar  Temperature 
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Figure  3.6-4.  This  temperature  thermocouple  (Sensor  2}  was 
mounted  on  the  outside  of  the  wing  leading  edge  spar  behind  the 
insulation  that  protects  the  spar  from  radiated  heat  from  the  RCC 
panels.  It  clearly  showed  an  off-nominal  trend  early  in  the  re-entry 
sequence  and  begon  to  show  an  increase  in  temperature  much 
earlier  than  the  temperature  sensor  behind  the  spar. 


Sensor  I  provided  the  first  anomalous  reading  (see  Figure 
3.6-3).  From  El+270  to  EI-i-360,  the  strain  is  higher  than  that 
on  previous  Coliinihia  flights.  At  El+450,  the  strain  reverses, 
and  then  peaks  again  in  a  negative  direction  at  EI+475.  The 
strain  then  drops  slightly,  and  remains  constant  and  negative 
until  EI+495,  when  the  sensor  pattern  becomes  unreliable, 
probably  due  to  a  propagating  soft  short,  or  "bum-through" 
of  the  insulation  between  cable  conductors  caused  by  heating 
or  combustion.  This  strain  likely  indicates  significant  damage 
to  the  aluminum  honeycomb  spar.  In  particular,  strain  rever- 
sals, which  are  unusual,  likely  mean  there  was  significant 
high-temperature  damage  to  the  spar  during  this  time. 

At  EI-t-290,  20  seconds  after  Sensor  1  gave  its  first  anoma- 
lous reading.  Sensor  2,  the  only  sensor  in  the  front  of  the 
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Figure  3.6-5.  The  analysis  of  the  effect  of  a  W-inch  hole  in  RCC 
panel  8  on  Sensor  2  from  El  to  EI+500  seconds.  The  jagged  line 
shows  the  actual  flight  data  readings  and  the  smooth  line  the 
calculated  result  for  a  10-inch  hole  with  some  sneak  flow  of  super- 
heated air  behind  the  spar  insulation. 


left  wing  leading  edge  spar,  recorded  the  beginning  of  a 
gradual  and  abnormal  rise  in  temperature  from  an  expected 
30  degrees  Fahrenheit  to  65  degrees  at  El+493,  when  it  then 
dropped  to  "off-scale  low,"  a  reading  that  drops  off  the  scale 
at  the  low  end  of  the  sensor's  range  (see  Figure  3.6-4).  Sen- 
sor 2,  one  of  the  first  to  fail,  did  so  abruptly.  It  had  indicated 
only  a  mild  warming  of  the  RCC  attachment  clevis  before 
the  signal  was  lost. 

A  series  of  thermal  analyses  were  performed  for  different 
sized  holes  in  RCC  panel  8  to  compute  the  time  required  to 
heat  Sensor  2  to  the  temperature  recorded  by  the  Modular 
Auxiliary  Data  System.  To  heat  the  clevis,  various  insula- 
tors would  have  to  be  bypassed  with  a  small  amount  of 
leakage,  or  "sneak  flow."  Figure  3.6-.*^  shows  the  results  of 
these  calculations  for,  as  an  example,  a  10-inch  hole,  and 
demonstrates  that  with  sneak  flow  around  the  insulation,  the 
temperature  profile  of  the  clevis  sensor  was  closely  matched 
by  the  engineering  calculations.  This  is  consistent  with  the 
same  sneak  flow  required  to  match  a  similar  but  abnormal 
a.scent  temperature  rise  of  the  same  sensor,  which  further 
supports  the  premise  that  the  breach  in  the  leading  edge  of 
the  wing  occurred  during  ascent.  While  the  exact  size  of  the 
breach  will  never  be  known,  and  may  have  been  smaller  or 
larger  than  10  inches,  these  analyses  do  provide  a  plausible 
explanation  for  the  observed  rises  in  temperature  sensor  data 
during  re-entry. 

Investigators  initially  theorized  that  the  foam  might  have 
broken  a  T-seal  and  allowed  superheated  air  to  enter  the 
wing  between  the  RCC  panels.  However,  the  amount  of 
T-seal  debris  from  this  area  and  subsequent  aerothermal 
analysis  showing  this  type  of  breach  did  not  match  the  ob- 
served damage  to  the  wing,  led  investigators  to  eliminate  a 
missing  T-seal  as  the  source  of  the  breach. 

Although  abnonnal,  the  re-entry  temperature  rise  was  slow 
and  small  compared  to  what  would  be  expected  if  Sensor  2 
were  exposed  to  a  blast  of  superheated  air  from  an  assumed 
breach  in  the  RCC  panels.  The  slow  temperature  rise  is  at- 
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Figure  3.6-6.  As  early  as  EI+370,  Sensor  3  began  reading  sig- 
nificantly higher  than  on  previous  flights.  Since  this  sensor  was 
located  in  a  thermal  tile  on  ffie  lower  surface  of  the  left  wing,  its 
temperatures  are  much  higher  than  those  for  the  other  sensors. 
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tributed  to  the  presence  of  a  relatively  modest  breach  in  the 
RCC,  the  thick  insulation  that  surrounds  the  sensor,  and  the 
distance  from  the  site  of  the  breach  in  RCC  panel  8  to  the 
clevis  sensor. 

The  readings  of  Sensor  3.  which  was  in  a  thermal  tile, 
began  rising  abnormally  high  and  somewhat  erratically  as 
early  as  EI+370,  with  several  brief  spikes  to  2,500  degrees 
Fahrenheit,  significantly  higher  than  the  2.000-degree  peak 
temperature  on  a  normal  re-entry  (Figure  3.6-6).  At  EI-i-496, 
this  reading  became  unreliable,  indicating  a  failure  of  the 
wire  or  the  sensor.  Because  this  thermocouple  was  on  the 
wing  lower  surface,  directly  behind  the  junction  of  RCC 
panel  9  and  10,  the  high  temperatures  it  initially  recorded 
were  almost  certainly  a  result  of  air  jetting  through  the  dam- 
aged area  of  RCC  panel  8,  or  of  the  normal  airflow  being 
disturbed  by  the  damage.  Note  that  Sensor  3  provided  an 
external  temperature  measurement,  while  Sensors  2  and  4 
provided  internal  temperature  measurements. 

Sensor  4  also  recorded  a  rise  in  temperature  that  ended  in  an 
abrupt  fall  to  off-scale  low.  Figure  3.6-7  shows  that  an  ab- 
normal temperature  rise  began  at  EI-(-425  and  abruptly  fell  at 
EI-(-525.  Unlike  Sensor  2.  this  temperature  rise  was  extreme, 
from  an  expected  20  degrees  Fahrenheit  at  EI-i-425  to  40  de- 
grees at  EI-i-485,  and  then  rising  much  faster  to  120  degrees 
at  EI-i-515,  then  to  an  off-scale  high  (a  reading  that  climbs 
off  the  scale  at  the  high  end  of  the  range)  of  450  degrees  at 
EI+522.  The  failure  pattern  of  this  sensor  likely  indicates 
destruction  by  extreme  heat. 

The  timing  of  the  failures  of  these  four  sensors  and  the  path 
of  their  cable  routing  enables  a  determination  of  both  the 
timing  and  location  of  the  breach  of  the  leading  edge  spar, 
and  indirectly,  the  breach  of  the  RCC  panels.  All  the  cables 
from  these  sensors,  and  many  others,  were  routed  into  wir- 
ing harnesses  that  ran  forward  along  the  back  side  of  the 
leading  edge  spar  up  to  a  cross  spar  (see  Figure  3.6-8),  where 
they  passed  through  the  service  opening  in  the  cross  spar 
and  then  ran  in  front  of  the  left  wheel  well  before  reaching 
interconnect  panel  65R  where  they  entered  the  fuselage.  All 
sensors  with  wiring  in  this  set  of  harnesses  failed  between 
EI+487  to  EI+497,  except  Sensor  4,  which  survived  until 
EI-i-522.  The  diversity  of  sensor  types  (temperature,  pres- 
sure, and  strains)  and  their  locations  in  the  left  wing  indi- 
cates that  they  failed  because  their  wiring  was  destroyed 
at  spar  burn-through,  as  opposed  to  destmction  of  each 
individual  sensor  by  direct  heating. 

Examination  of  wiring  installation  closeout  photographs  (pic- 
tures that  document  the  state  of  the  area  that  are  normally  taken 
just  before  access  is  closed)  and  engineering  drawings  show 
five  main  wiring  harness  bundles  running  forward  along  the 
spar,  labeled  top  to  bottom  as  A  through  E  (see  Figure  3.6-8). 
The  top  four,  A  through  D.  are  spaced  3  inches  apart,  while 
the  fifth,  E.  is  6  inches  beneath  them.  The  separation  between 
bundle  E  and  the  other  four  is  consistent  with  the  later  fail- 
ure time  of  Sensor  4  by  25  to  29  seconds,  and  indicates  that 
the  breach  was  in  the  upper  two-thirds  of  the  spar,  causing 
all  but  one  of  the  cables  in  this  area  to  fail  between  EI4-487 
to  EI+497.  The  breach  then  expanded  vertically,  toward  the 
underside  of  the  wing,  causing  Sensor  4  to  fail  25  seconds 


V09T9895A  -  Left  Wing  Front  Spar  Panel  9  Temperature 


500 

400 

300 

u.  200 

a  100 


d 


STS-  107 
STS  •  073 

STS    090 
STS-  109 


100        200       300       400       500       600       700       800       900       1000 
Time  (seconds  from  El) 


Figure  3.6-7.  Sensor  4  also  began  reading  s/gnificonf/y  higher 
than  previous  flights  before  it  fell  off-scale  low.  The  relatively  late 
reaction  of  this  sensor  compared  to  Sensor  2,  clearly  indicated 
that  superheated  air  started  on  ffie  outside  of  the  wing  leading 
edge  spar  and  then  moved  into  the  mid-wing  after  the  spar  was 
burned  through.  Note  that  immediately  before  the  sensor  (or  the 
wire)  fails,  the  temperature  is  at  450  degrees  Fahrenheit  and 
climbing  rapidly.  It  was  the  only  temperature  sensor  that  showed 
this  pattern. 


later.  Because  the  distance  between  bundle  A  and  bundle  E 
is  9  inches,  the  failure  of  all  the.se  wires  indicates  that  the 
breach  in  the  wing  leading  edge  spar  was  at  least  9  inches 
from  top  to  bottom  by  EI-i-522  seconds. 


^■v09T9895aJ^^,,,«j^                        JH 

Figure  3.6-8.  The  left  photo  above  shows  the  wiring  runs  on  the 
backside  of  the  wing  leading  edge  behind  RCC  panel  8  -  the  cir- 
cle marks  the  most  likely  area  where  the  burn  through  of  the  wing 
leading  edge  spar  initially  occurred  at  EI+487  seconds.  The  right 
photo  shows  the  wire  bundles  as  they  continue  forward  behind 
RCC  panels  7  and  6.  The  major  cable  bundles  in  the  upper  right 
of  the  right  photo  carried  the  majority  of  the  sensor  data  inside 
the  wing.  As  these  bundles  were  burned,  controllers  on  the  ground 
began  seeing  off-nominal  sensor  indicofions. 
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Also  directly  behind  RCC  pane!  8  were  pressure  sensors 
V07P80I0A  (Sensor  5),  on  the  upper  interior  surface  of 
the  wing,  and  V07P8058A  (Sensor  6).  on  the  lower  interior 
surface  of  the  wing.  Sensor  5  failed  abruptly  at  El+497. 
Sensor  6,  which  was  slightly  more  protected,  began  falling 
at  EI+495,  and  failed  completely  at  EI+505.  Closeout  pho- 
tographs show  that  the  wiring  from  Sensor  5  travels  down 
from  the  top  of  the  wing  to  join  the  uppermost  harness.  A, 
which  then  travels  along  the  leading  edge  spar.  Similarly, 
wiring  from  Sensor  6  travels  up  from  the  bottom  of  the  wing, 
joins  harness  A,  and  continues  along  the  spar.  It  appears  that 
Sensor  5's  wiring,  on  the  upper  wing  surface,  was  damaged 
at  El+497,  right  after  Sensor  1  failed.  Noting  the  times  of  the 
sensor  failures,  and  the  locations  of  Sensors  5  and  6  forward 
of  Sensors  1  through  4,  spar  burn-through  must  have  oc- 
curred near  where  these  wires  came  together. 

Two  of  the  45  left  wing  strain  gauges  also  recorded  an  anom- 
aly around  EI-)-5()0  to  EI+580,  but  their  readings  were  not 
erratic  or  off-scale  until  late  in  the  re-entry,  at  EI-t-930.  Strain 
gauge  V12G9048A  was  far  forward  on  a  cross  spar  in  the 
frontof  the  wheel  well  on  the  lower  spar  cap,  and  strain  gauge 
V 1 2G9049A  was  on  the  upper  spar  cap.  Their  responses  ap- 
pear to  ba  the  actual  strain  at  that  location  until  their  failure 
at  EI-i-935.  The  exposed  wiring  for  most  of  the  left  wing  sen- 
sors runs  along  the  front  of  the  spar  that  crosses  in  front  of 
the  left  wheel  well.  The  very  late  failure  times  of  these  two 
sensors  indicate  that  the  damage  did  not  spread  into  the  wing 
cavity  forward  of  the  wheel  well  until  at  least  EI-(-935,  which 
implies  that  the  breach  was  aft  of  the  cross  spar.  Because  the 
cross  spar  attaches  to  the  transition  spar  behind  RCC  panel 
6,  the  breach  must  have  been  aft  (outboard)  of  panel  6.  The 
superheated  air  likely  burned  through  the  outboard  wall  of 
the  wheel  well,  rather  than  snaking  forward  and  then  back 
through  the  vent  at  the  front  of  the  wheel  well.  Had  the  gases 
flowed  through  the  access  opening  in  the  cross  spar  and  then 
through  the  vent  into  the  wheel  well,  it  is  unlikely  that  the 
lower  strain  gauge  wiring  would  have  survived. 
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Figure  3.6-9.  Orbifal  Maneuvering  System  (OMS)  pod  heating 
was  initially  significantly  lower  than  that  seen  on  previous  Colum- 
bia missions.  As  wing  leading  edge  damage  later  increased,  the 
OMS  pod  heating  increased  dramatically.  Debris  recovered  from 
this  area  of  the  OMS  pod  showed  substantial  pre-breakup  heat 
damage  and  imbedded  drops  of  once-molten  metal  from  the  wing 
leading  edge  in  the  OMS  pod  thermal  tiles. 


Finally,  the  rapid  rise  in  Sensor  4  at  EI+425,  before  the  other 
sensors  began  to  fail,  indicates  that  high  temperatures  were 
responsible.  Coinparisons  of  sensors  on  the  outside  of  the 
wing  leading  edge  spar,  those  inside  of  the  spar,  and  those  in 
the  wing  and  left  wheel  well  indicate  that  abnormal  heating 
first  began  on  the  outside  of  the  spar  behind  the  RCC  panels 
and  worked  through  the  spar.  Since  the  aluminum  spar  must 
have  burned  through  before  any  cable  harnesses  attached  to 
it  failed,  the  breach  through  the  wing  leading  edge  spar  must 
have  occurred  at  or  before  EI-<-487. 

Other  abnormalities  also  occurred  during  re-entry.  Early  in 
re-entry,  the  heating  normally  .seen  on  the  left  Orbital  Ma- 
neuvering System  pod  was  much  lower  than  usual  for  this 
point  in  the  flight  (.see  Figure  3.6-9).  Wind  tunnel  testing 
demonstrated  that  airflow  into  a  breach  in  an  RCC  panel 
would  then  escape  through  the  wing  leading  edge  vents 
behind  the  upper  pail  of  the  panel  and  interrupt  the  weak 
aerodynamic  flow  held  on  top  of  the  wing.  During  re-entry, 
air  normally  flows  into  these  vents  to  equalize  air  pressure 
across  the  RCC  panels.  The  interruption  in  the  flow  field 
behind  the  wing  caused  a  displacement  of  the  vortices  that 
normally  hit  the  leading  edge  of  the  left  pod,  and  resulted 
in  a  slowing  of  pod  heating.  Heating  of  the  side  fuselage 
slowed,  which  wind  tunnel  testing  also  predicted. 

To  match  this  scenario,  investigators  had  to  postulate  dam- 
age to  the  tiles  on  the  upper  carrier  panel  9,  in  order  to 
allow  sufficient  mass  flow  through  the  vent  to  cause  the 
observed  decrease  in  sidewall  heating.  No  upper  carrier 
panels  were  found  from  panels  9,  10,  and  1 1 .  which  supports 
this  hypothesis.  Although  this  can  account  for  the  abnormal 
temperatures  on  the  body  of  the  Orbiter  and  at  the  Orbital 
Maneuvering  System  pod,  flight  data  and  wind  tunnel  tests 
confirmed  that  this  venting  was  not  strong  enough  to  alter 
the  aerodynamic  force  on  the  Orbiter,  and  the  aerodynamic 
analysis  of  mission  data  showed  no  change  in  Orbiter  flight 
control  parameters  during  this  time. 

During  re-entry,  a  change  was  noted  in  the  rate  of  the  tem- 
perature rise  around  the  RCC  chin  panel  clevis  temperature 
sensor  and  two  water  supply  nozzles  on  the  left  side  of  the 
fuselage,  just  aft  of  the  main  bulkhead  that  divides  the  crew 
cabin  from  the  payload  bay.  Because  these  sensors  were  well 
forward  of  the  dainage  in  the  left  wing  leading  edge,  it  is  still 
unclear  how  their  indications  fit  into  the  failure  scenario. 

Sensor  Loss  and  the  Onset  of  Unusual  Aerodynamic 
Effects  (EI+500  through  EI+611) 

Fourteen  seconds  after  the  loss  of  the  first  sensor  wire  on  the 
wing  leading  edge  spar  at  EI-t-487,  a  sensor  wire  in  a  bundle 
of  some  150  wires  that  ran  along  the  upper  outside  comer 
of  the  left  wheel  well  showed  a  bum-through.  In  the  ne.xt  50 
seconds,  more  than  70  percent  of  the  sensor  wires  in  three 
cables  in  this  area  also  burned  through  (see  Figure  3.6-10). 
Investigators  plotted  the  wiring  run  for  every  left-wing  sen- 
sor, looking  for  a  relationship  between  their  location  and 
time  of  failure. 

Only  two  sensor  wires  of  169  remained  intact  when  the 
Modular  Auxiliary  Data  System  recorder  stopped,  indicat- 
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Figure  3.6-10.  This  chart  shows  how  rapidly  the  wire  bundles  in  the  left  wing  were  destroyed.  Over  70  percent  of  the  sensor  wires  in  ffie 
wiring  bundles  burned  through  in  under  a  minute.  The  black  diamonds  show  the  times  of  significant  timeline  sensor  events. 


ing  that  the  bum-throughs  had  to  occur  in  an  area  that  nearly 
every  wire  ran  through.  To  sustain  this  type  of  damage,  the 
wires  had  to  be  close  enough  to  the  breach  for  the  gas  plume 
to  hit  them.  Arc  jet  testing  (in  a  wind  tunnel  with  an  electri- 
cal arc  that  provides  up  to  a  2.800-degree  Fahrenheit  air- 
flow) on  a  simulated  wing  leading  edge  spar  and  simulated 
wire  bundles  showed  how  the  leading  edge  spar  would  burn 
through  in  a  few  seconds.  It  also  showed  that  wire  bundles 
would  burn  through  in  a  timeframe  consistent  with  those 
seen  in  the  Modular  Auxiliary  Data  System  information  and 
the  telemetered  data. 

Later  computational  fluid  dynamics  analysis  of  the  mid- 
wing  area  behind  the  spar  showed  that  superheated  air 
flowing  into  a  breached  RCC  panel  8  and  then  interacting 
with  the  internal  structure  behind  the  RCC  cavity  (RCC  ribs 
and  spar  insulation)  would  have  continued  through  the  wing 
leading  edge  spar  as  a  jet.  and  would  have  easily  allowed 
superheated  air  to  traverse  the  56.5  inches  from  the  spar  to 
the  outside  of  the  wheel  well  and  destroy  the  cables  (Figure 
3.6-1 1 ).  Controllers  on  the  ground  saw  these  first  anomalies 
in  the  telemetry  data  at  EI-i-613.  when  four  hydraulic  sensor 
cables  that  ran  from  the  aft  part  of  the  left  wing  through  the 
wiring  bundles  outside  the  wheel  well  failed. 

Aerodynamic  roll  and  yaw  forces  began  to  differ  from  those 
on  previous  flights  at  about  EI-i-500  (see  Figure  3.6-12).  In- 
vestigators used  flight  data  to  reconstruct  the  aerodynamic 
forces  acting  on  the  Orbiter.  This  reconstructed  data  was  then 
compared  to  forces  seen  on  other  similar  flights  of  Coliiinhici 
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Contours  of  Velocify  Magnitude  (fps)  Jun  10,  2003 

FLUENT  6.1  (2d,  coupled  imp,  ske) 


Figure  3.6-11.  The  computational  fluid  dynamics  analysis  of  the 
speed  of  the  superheated  air  as  it  entered  the  breach  in  RCC  panel 
8  and  ffien  traveled  through  the  wing  leading  edge  spar.  The  dark- 
est red  color  indicates  speeds  of  over  4,000  miles  per  hour.  Tem- 
peratures in  this  area  likely  exceeded  5,000  degrees  Fahrenheit. 
The  area  of  detail  is  looking  down  at  the  top  of  the  left  wing. 
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Figure  3,6-J2,  Af  approximately  E/+500  seconds,  the  aerodynamic  roll  and  yaw  forces  began  to  diverge  from  those  observed  on  previous 
flights.  The  blue  line  shows  the  Orbiter's  tendency  to  yaw  while  the  red  line  shows  its  tendency  to  roll.  Nominal  values  would  parallel  the 
solid  b/ocfe  line.  Above  the  black  line,  the  direction  of  the  force  is  to  the  right,  while  below  the  black  line,  the  force  is  to  the  left. 


and  to  the  forces  predicted  tor  STS- 1 07.  In  the  early  phase 
of  fight,  these  abnormal  aerodynamic  forces  indicated  that 
C(>lunihia\  flight  control  system  was  reacting  to  a  change 
in  the  external  shape  of  the  wing,  which  was  caused  by  pro- 
gressive RCC  damage  that  caused  a  continuing  decrease  in 
lift  and  a  continuing  increase  in  drag  on  the  left  wing. 

Between  EI-(-530  and  EI-)-562,  four  sensors  on  the  left  in- 
board elevon  failed.  These  sensor  readings  were  part  of  the 
data  telemetered  to  the  ground.  Noting  the  system  failures, 
the  Maintenance,  Mechanical,  and  Crew  Systems  officer 
notified  the  Flight  Director  of  the  failures.  (See  sidebar  in 
Chapter  2  for  a  complete  version  of  the  Mission  Control 
Center  conversation  about  this  data.) 

At  EI-t-555,  Colinnbiu  crossed  the  California  coast.  People 
on  the  ground  now  saw  the  damage  developing  on  the  Or- 
biter  in  the  form  of  debris  being  shed,  and  documented  this 
with  video  cameras.  In  the  next  15  seconds,  temperatures 
on  the  fuselage  sidewall  and  the  left  Orbital  Maneuvering 
System  pod  began  to  rise.  Hypersonic  wind  tunnel  tests  indi- 
cated that  the  increased  heating  on  the  Orbital  Maneuvering 
System  pod  and  the  roll  and  yaw  changes  were  caused  by 


substantial  leading  edge  damage  around  RCC  panel  9.  Data 
on  Orbiter  temperature  distribution  as  well  as  aerodynamic 
forces  for  various  damage  scenarios  were  obtained  from 
wind  tunnel  testing. 

Figure  3.6-13  shows  the  comparison  of  surface  temperature 
distribution  with  an  undamaged  Orbiter  and  one  with  an  en- 
tire panel  9  removed.  With  panel  9  removed,  a  strong  vortex 
flow  structure  is  positioned  to  increase  the  temperature  on 
the  leading  edge  of  the  Orbital  Maneuvering  System  pod. 
The  aim  is  not  to  demonstrate  that  all  of  panel  9  was  miss- 
ing at  this  point,  but  rather  to  indicate  that  major  damage  to 
panels  near  panel  9  can  shift  the  strong  vortex  flow  pattern 
and  change  the  Orbiter's  temperature  distribution  to  match 
the  Modular  Auxiliary  Data  System  information.  Wind  tun- 
nel tests  also  demonstrated  that  increasing  damage  to  lead- 
ing edge  RCC  panels  would  result  in  increasing  drag  and 
decreasing  lift  on  the  left  wing. 

Recovered  debris  showed  that  Inconel  718,  which  is  only 
found  in  wing  leading  edge  spanner  beams  and  attachment 
fittings,  was  deposited  on  the  left  Orbital  Maneuvering  Sys- 
tem pod.  verifying  that  airflow  through  the  breach  and  out 
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of  the  upper  slot  carried  molten  wing  leading  edge  material 
back  to  the  pod.  Temperatures  far  exceeded  those  seen  on 
previous  re-entries  and  further  confirmed  that  the  wing  lead- 
ing-edge damage  was  increasing. 

By  this  time,  superheated  air  had  been  entering  the  wing 
since  EI+487.  and  significant  internal  damage  had  probably 
occurred.  The  major  internal  support  structure  in  the  mid- 
wing  consists  of  aluminum  trusses  with  a  melting  point  of 
1.200  degrees  Fahrenheit.  Because  the  ingested  air  may  have 
been  as  hot  as  8.000  degrees  near  the  breach,  it  is  likely  that 
the  internal  support  structure  that  maintains  the  shape  of  the 
wing  was  severely  compromised. 

As  the  Orbiter  Hew  east,  people  on  the  ground  continued  to 
record  the  major  shedding  of  debris.  Investigators  later  scru- 
tinized these  videos  to  compare  Coliiinhia's  re-entry  with 
recordings  of  other  re-entries  and  to  identify  the  debris.  The 
video  analysis  was  also  used  to  determine  additional  search 
areas  on  the  ground  and  to  estimate  the  size  of  various  pieces 
of  debris  as  they  fell  from  the  Orbiter. 

Temperatures  in  the  wheel  well  began  to  rise  rapidly  at 
EI-(-601.  which  indicated  that  the  superheated  air  coming 
through  the  wing  leading  edge  spar  had  breached  the  wheel 
well  wall.  At  the  same  time,  observers  on  the  ground  noted 
additional  significant  shedding  of  debris.  Analysis  of  one  of 
these  "debris  events"  showed  that  the  photographed  object 
could  have  weighed  nearly  190  pounds,  which  would  have 
significantly  altered  Columbia's  physical  condition. 

At  EI+602.  the  tendency  of  the  Orbiter  to  roll  to  the  left  in 
response  to  a  loss  of  lift  on  the  left  wing  transitioned  to  a 
right-rolling  tendency,  now  in  response  to  increased  lift  on 
the  left  wing.  Observers  on  the  ground  noted  additional  sig- 
nificant shedding  of  debris  in  the  next  30  seconds.  Left  yaw 
continued  to  increase,  consistent  with  increasing  drag  on  the 
left  wing.  Further  damage  to  the  RCC  panels  explains  the 
increased  drag  on  the  left  wing,  but  it  does  not  explain  the 
sudden  increase  in  lift,  which  can  be  explained  only  by  some 
other  type  of  wing  damage. 

Investigators  ran  multiple  analyses  and  wind  tunnel  tests 
to  understand  this  significant  aerodynamic  event.  Analysis 
showed  that  by  EI-t-850,  the  temperatures  inside  the  wing 
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Figure  3.6-)3.  The  effects  of  removing  RCC  panel  9  ore  shown  in 
this  figure.  Note  the  brighter  colors  on  the  front  of  the  OMS  pod 
show  increased  heofing,  o  phenomenon  supported  by  both  the 
OMS  pod  femperafure  sensors  and  the  debris  analysis. 


The  Kirtland  Image 


As  Columbia  passed  over  Albuquerque,  New  Mexico,  during 
re-entr\'  (around  EI+795),  scientists  at  the  Air  Force  Starfire 
Optical  Range  at  Kirtland  Air  Force  Base  acquired  images  of 
the  Orbiter.  This  imaging  had  not  been  officially  assigned, 
and  the  photograph  was  taken  using  commercial  equipment 
located  at  the  site,  not  with  the  advanced  Starfire  adaptive- 
optics  telescope. 


The  image  shows  an  unusual  condition  on  the  iefl  wing,  a 
leading-edge  disturbance  that  might  indicate  damage.  Sev- 
eral analysts  concluded  that  the  distortion  evident  in  the 
image  likely  came  from  the  modification  and  interaction  of 
shock  waves  due  to  the  damaged  leading  edge.  The  overall 
appearance  of  the  leading-edge  damage  at  this  point  on  the 
trajectory  is  consistent  with  the  scenario. 


were  high  enough  to  substantially  damage  the  wing  skins, 
wing  leading  edge  spar,  and  the  wheel  well  wall,  and  melt 
the  wing's  support  struts.  Once  structural  support  was  lost, 
the  wing  likely  deformed,  effectively  changing  shape  and  re- 
sulting in  increased  lift  and  a  corresponding  increase  in  drag 
on  the  left  wing.  The  increased  drag  on  the  left  wing  further 
increased  the  Orbiter 's  tendency  to  yaw  left. 

Loss  of  Vehicle  Control  (EI+612  through  EI+970) 

A  rise  in  hydraulic  line  temperatures  inside  the  left  wheel 
well  indicated  that  superheated  air  had  penetrated  the  wheel 
well  wall  by  EI-i-727.  This  temperature  rise,  telemetered  to 
Mission  Control,  was  noted  by  the  Maintenance,  Mechani- 
cal, and  Crew  Systems  officer.  The  Orbiter  initiated  and 
completed  its  roll  reversal  by  EI-(-766  and  was  positioned 
left-wing-down  for  this  portion  of  re-entry.  The  Guidance 
and  Flight  Control  Systems  performed  normally,  although 
the  aero-control  surfaces  (aileron  trim)  continued  to  counter- 
act the  additional  drag  and  lift  from  the  left  wing. 

At  EI-i-790,  two  left  main  gear  outboard  tire  pressure  sen- 
sors began  trending  slightly  upward,  followed  very  shortly 
by  going  off-scale  low,  which  indicated  extreme  heating  of 
both  the  left  inboard  and  outboard  tires.  The  tires,  with  their 
large  mass,  would  require  substantial  heating  to  produce  the 
sensors'  slight  temperature  rise.  Another  sharp  change  in  the 
rolling  tendency  of  the  Orbiter  occurred  at  EI-i-834,  along 
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Lower  Left  wing  debris 


Lower  Right  wing  debris 


Figure  3.7-1,  Comparison  of  amount  of  debris  recovered  from  the  left  and  right  vv/ngs  of  Columbia.  Nofe  the  amount  of  debris  recovered 
from  areas  in  front  of  the  wheel  well  (the  red  boxes  on  eocfi  wing)  were  similar,  but  there  were  dramatic  differences  in  the  amount  of  debris 
recovered  aft  of  each  wheel  well. 


with  additional  shedding  of  debris.  In  an  attempt  to  maintain 
attitude  control,  the  Orbiter  responded  with  a  sharp  change 
in  aileron  trim,  which  indicated  there  was  another  significant 
change  to  the  left  wing  configuration,  likely  due  to  wing  de- 
formation. By  El+887,  all  left  main  gear  inboard  and  out- 
board tire  pressure  and  wheel  temperature  measurements 
were  lost,  indicating  burning  wires  and  a  rapid  progression 
of  damage  in  the  wheel  well. 

At  EI+897.  the  left  main  landing  gear  downlock  position 
indicator  reported  that  the  gear  was  now  down  and  locked. 
At  the  same  time,  a  sensor  indicated  the  landing  gear  door 
was  still  closed,  while  another  sensor  indicated  that  the 
main  landing  gear  was  still  locked  in  the  up  position.  Wire 
burn-through  testing  showed  that  a  burn-induced  short  in  the 
downlock  sensor  wiring  could  produce  these  same  contra- 
dictions in  gear  status  indication.  Several  measurements  on 
the  strut  produced  valid  data  until  the  final  loss  of  telemetry 
data.  This  suggests  that  the  gear-down-and  locked  indica- 
tion was  the  result  of  a  wire  burn-through,  not  a  result  of 
the  landing  gear  actually  deploying.  All  four  corresponding 
proximity  switch  sensors  for  the  right  main  landing  gear  re- 
mained normal  throughout  re-entry  until  telemetry  was  lost. 


Figure  3.7-2.  Each  RCC  panel  has  a  U-shaped  slot  (see  arrow)  in 
the  back  of  the  panel.  Once  superheated  air  entered  the  breach 
in  RCC  panel  8,  some  of  that  superheated  air  went  through  this 
slot  and  caused  substantial  damage  to  the  Thermal  Protection 
System  tiles  behind  this  area. 
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Post-accident  analysis  of  flight  data  that  was  generated  af- 
ter telemetry  information  was  lost  showed  another  abrupt 
change  in  the  Orbiter's  aerodynamics  caused  by  a  contin- 
ued progression  of  left  wing  damage  at  El-t-917.  The  data 
showed  a  significant  increase  in  positive  roll  and  negative 
yaw,  again  indicating  another  increase  in  drag  on  and  lift 
from  the  damaged  left  wing.  Coliiiiihia's  flight  control  sys- 
tem attempted  to  compensate  for  this  increased  left  yaw  by 
firing  all  four  right  yaw  jets.  Even  with  all  thrusters  firing, 
combined  with  a  maximum  rate  of  change  of  aileron  trim,  the 
flight  control  system  was  unable  to  control  the  left  yaw,  and 
control  of  the  Orbiter  was  lost  at  El -(-970  seconds.  Mission 
Control  lost  all  telemetr\'  data  from  the  Orbiter  at  EI-(-923 
(8:59:32  a.m.).  Civilian  and  military  video  cameras  on  the 
ground  documented  the  final  breakup.  The  Modular  Auxil- 
iary Data  System  stopped  recording  at  EI-i-970  seconds. 

Findings: 

F3.6-I  The  de-orbit  burn  and  re-entry  flight  path  were 
normal  until  just  before  Loss  of  Signal. 

F3.6-2  Coliiiiihia  re-entered  the  atmosphere  with  a  pre- 
existing breach  in  the  left  wing. 

F3.6-3  Data  from  the  Modular  Auxiliar)  Data  System 
recorder  indicates  the  location  of  the  breach  was 
in  the  RCC  panels  on  the  left  wing  leading  edge. 

F3.6-4  Abnormal  heating  events  preceded  abnormal 
aerodynamic  events  by  several  minutes. 

F3.6-5  By  the  time  data  indicating  problems  was  teleme- 
tered to  Mission  Control  Center,  the  Orbiter  had 
already  suffered  damage  from  which  it  could  not 
recoN'er. 

Recommendations: 

R3.6-I  The  Modular  .Auxiliary  Data  System  instrumen- 
tation and  sensor  suite  on  each  Orbiter  should  be 
maintained  and  updated  to  include  cuaent  sensor 
and  data  acquisition  technologies. 

R3.6-2  The  Modular  Auxiliary  Data  System  should  be 
redesigned  to  include  engineering  peiformance 
and  vehicle  health  information,  and  have  the 
ability  to  be  reconfigured  during  flight  in  order  to 
allow  certain  data  to  be  recorded,  telemetered,  or 
both,  as  needs  change. 

3.7    Debris  Analysis 

The  Board  performed  a  detailed  and  exhaustive  investigation 
of  the  debris  that  was  recovered.  While  sensor  data  from  the 
Orbiter  pointed  to  early  problems  on  the  left  wing,  it  could 
only  isolate  the  breach  to  the  general  area  of  the  left  wing 
RCC  panels.  Forensics  analysis  independently  determined 
that  RCC  panel  8  was  the  most  likely  site  of  the  breach,  and 
this  was  subsequently  corroborated  by  other  analyses.  (See 
Appendix  D.  1 1.) 

Pre-Breokup  and 

Post-Breakup  Damage  Determination 

Differentiating  between  pre-breakup  and  post-breakup  dam- 
age pnncd  a  challcncc.  When  Cnliiiiihid's  main  body  break- 


up occurred,  the  Orbiter  was  at  an  altitude  of  about  200,000 
feet  and  traveling  at  Mach  19,  well  within  the  peak-heating 
region  calculated  for  its  re-entry  profile.  Consequently,  as 
individual  pieces  of  the  Orbiter  were  exposed  to  the  at- 
mosphere at  breakup,  they  experienced  temperatures  high 
enough  to  damage  them.  If  a  part  had  been  damaged  by  heat 
prior  to  breakup,  high  post-breakup  temperatures  could  eas- 
ily conceal  the  pre-breakup  evidence.  In  some  cases,  there 
was  no  clear  way  to  determine  what  happened  when.  In 
other  cases,  heat  erosion  occurred  over  fracture  surfaces,  in- 
dicating the  piece  had  first  broken  and  had  then  experienced 
high  temperatures.  Investigators  concluded  that  pre-  and 
post-breakup  damage  had  to  be  determined  on  a  part-by-part 
basis:  it  was  impossible  to  make  broad  generalizations  based 
on  the  gross  physical  evidence. 

Amount  of  Right  Wing  Debris 
versus  Left  Wing  Debris 

Detailed  analysis  of  the  debris  revealed  unique  features 
and  convincing  evidence  that  the  damage  to  the  left  wing 
differed  significantly  from  damage  to  the  right,  and  that  sig- 
nificant differences  existed  in  pieces  from  various  areas  of 
the  left  wing.  While  a  substantial  amount  of  upper  and  lower 
right  wing  structure  was  recovered,  comparatively  little  of 
the  upper  and  lower  left  wing  structure  was  recovered  (see 
Figure  3.7-1). 

The  difference  in  recovered  debris  from  the  Orbiter's  wings 
clearly  indicates  that  after  the  breakup,  most  of  the  left  wing 
succumbed  to  both  high  heat  and  aerodynamic  forces,  while 
the  right  wing  succumbed  to  aerodynamic  forces  only.  Be- 
cause the  left  wing  was  already  compromised,  it  was  the  first 
area  of  the  Orbiter  to  fail  structurally.  Pieces  were  exposed 
to  higher  heating  for  a  longer  period,  resulting  in  more  heat 
damage  and  ablation  of  left  wing  structural  material.  The  left 
wing  was  also  subjected  to  superheated  air  that  penetrated 
directly  into  the  mid-body  of  the  wing  for  a  substantial 
period.  This  pre-heating  likely  rendered  those  components 
unable  to  absorb  much,  if  any,  of  the  post-breakup  heating. 
Those  internal  and  external  structures  were  likely  vaporized 
during  post-breakup  re-entry.  Finally,  the  left  wing  likely 
lost  significant  amounts  of  the  Thermal  Protection  System 
prior  to  breakup  due  to  the  effect  of  internal  wing  heating  on 
the  Thermal  Protection  System  bonding  materials,  and  this 
further  degraded  the  left  wing's  ability  to  resist  the  high  heat 
of  re-entry  after  it  broke  up. 

Tile  Slumping  and  External  Patterns  of  Tile  Loss 

Tiles  recovered  from  the  lower  left  wing  yielded  their  own 
interesting  clues.  The  left  wing  lower  carrier  panel  9  tiles 
sustained  extreme  heat  damage  (slumping)  and  showed  more 
signs  of  erosion  than  any  other  tiles.  This  severe  heat  erosion 
damage  was  likely  caused  by  an  oiiffitw  of  superheated  air 
and  molten  inaterial  from  behind  RCC  panel  8  through 
a  U-shaped  design  gap  in  the  panel  (see  Figure  3.7-2) 
that  allows  room  for  the  T-scal  attachment.  Effluents  from 
the  back  side  of  panel  8  would  directly  impact  this  area  of 
lower  carrier  panel  9  and  its  tiles.  In  addition,  flow  lines  in 
these  tiles  (see  Figure  3.7-3)  exhibit  evidence  of  superheated 
airflow  across  their  surface  from  the  area  of  the  RCC  panel 
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Figure  3.7-3.  Superheated  airflow  caused  erosion  in  files  around 
the  RCC  panel  8  and  9  inferfoce.  Tfie  tiles  shown  are  from  behind 
the  area  where  the  superheated  air  exited  from  the  slot  in  Figure 
3.7-2.  These  tiles  showed  much  greater  thermal  damage  than 
other  tiles  in  this  area  and  chemical  analysis  showed  the  presence 
of  metals  only  found  in  wing  leading  edge  components. 


8  and  9  interface.  Chemical  analysis  shows  that  these  car- 
rier panel  tiles  were  covered  with  molten  Inconel,  which  is 
found  in  wing  leading  edge  attachment  fittings,  and  other 
metals  coming  from  inside  the  RCC  cavity.  Skimping  and 
heavy  erosion  of  this  magnitude  is  not  noted  on  tiles  from 
anywhere  else  on  the  Orbiter. 

Failure  modes  of  recovered  tiles  from  the  left  and  the  right 
wing  also  differ.  Most  right  wing  tiles  were  simply  broken 
off  the  wing  due  to  aerodynamic  forces,  which  indicates  that 
they  failed  due  to  physical  overload  at  breakup,  not  because 
of  heat.  Most  of  the  tiles  on  the  left  wing  behind  RCC  panels 
8  and<9  show  significant  evidence  of  backside  healing  of 
the  wing  skin  and  failure  of  the  adhesive  that  held  the  tiles 
on  the  wing.  This  pattern  of  failure  suggests  that  heat  pen- 
etrated the  left  wing  cavity  and  then  heated  the  aluminum 
skin  front  the  inside  out.  As  the  aluminum  skin  was  heated. 


the  strength  of  the  tile  bond  degraded,  and  tiles  separated 
from  the  Orbiter. 

Erosion  of  Left  Wing  Reinforced  Carbon-Carbon 

Several  pieces  of  left  wing  RCC  showed  unique  signs  of 
heavy  erosion  from  exposure  to  extreme  heat.  There  was 
erosion  on  two  rib  panels  on  the  left  wing  leading  edge  in 
the  RCC  panel  8  and  9  interface.  Both  the  outboard  rib  of 
panel  8  and  the  inboard  rib  of  panel  9  showed  signs  of  ex- 
treme heating  and  erosion  (see  Figure  3.7-4).  This  erosion 
indicates  that  there  was  extreme  heat  behind  RCC  panels  8 
and  9.  This  type  of  RCC  erosion  was  not  seen  on  any  other 
part  of  the  left  or  right  wing. 

Locations  of  Reinforced  Carbon-Carbon  Debris 

The  location  of  debris  on  the  ground  also  provided  evidence 
of  where  the  initial  breach  occurred.  The  location  of  every 
piece  of  recovered  RCC  was  plotted  on  a  map  and  labeled 
according  to  the  panel  the  piece  originally  came  from.  Two 
distinct  patterns  were  immediately  evident.  First,  it  was 
clear  that  pieces  from  left  wing  RCC  panels  9  through  22 
had  fallen  the  farthest  west,  and  that  RCC  from  left  wing 
panels  1  through  7  had  fallen  considerably  farther  east  (see 
Figure  3.7-5).  Second,  pieces  from  left  wing  panel  8  were 


Panel  7 
Panel  8 
Panel  9 
Panel  10 
-Panel  11 


Figure  3.7-4.  The  outboard  rib  of  panel  8  and  the  inboard  rib  of 
panel  9  showed  signs  of  exfreme  heating  and  erosion.  RCC  ero- 
sion of  this  magnitude  was  not  observed  in  any  other  location  on 
the  Orbiter. 


Figure  3.7-6.  The  tiles  recovered  farthest  west  all  came  from  the 
area  immediately  behind  left  wing  RCC  panels  8  and  9.  In  the 
Figure,  each  small  box  represenfs  an  individual  tile  on  ffie  lower 
surface  of  the  left  wing.  The  more  red  an  individual  tile  appears, 
the  farther  west  it  was  found. 
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Figure  3.7-5.  The  location  of  RCC  panel  debris  from  the  left  and  right  wings,  shown  where  it  was  recovered  from  in  East  Texas.  The  debris 
pattern  suggested  that  the  left  wing  failed  before  the  right  wing,  most  likely  near  left  RCC  panels  8  and  9. 


found  throughout  the  debris  field,  which  suggested  that  the 
left  wing  likely  failed  in  the  vicinity  of  RCC  panel  8.  The 
early  loss  of  the  left  wing  from  RCC  panel  9  and  outboard 
caused  the  RCC  from  that  area  to  be  deposited  well  west 
of  the  RCC  from  the  inboard  part  of  the  wing.  Since  panels 
I  through  7  were  so  much  farther  to  the  east,  investigators 
concluded  that  RCC  panels  I  through  7  had  stayed  with  the 
Orbiter  longer  than  had  panels  8  through  22. 

Tile  Locations 

An  analysis  of  where  tiles  were  found  on  the  ground  also 
yielded  significant  evidence  of  the  breach  location.  Since 
most  of  the  tiles  are  of  similar  size,  weight,  and  shape,  they 
would  all  have  similar  ballistic  coefficients  and  would  have 
behaved  similarly  after  they  separated  from  the  Orbiter.  By 
noting  where  each  tile  fell  and  then  plotting  its  location  on 
the  Orbiter  tile  map,  a  distinctive  pattern  emerged.  The  tiles 
recovered  farthest  west  all  came  from  the  area  immediately 
behind  the  left  wing  RCC  panel  H  and  9  (see  Figure  3.7-6), 
which  suggests  that  these  tiles  were  released  earlier  than 
those  from  other  areas  of  the  left  wing.  While  it  is  not  con- 
clusive evidence  of  a  breach  in  this  area,  this  pattern  does 
suggest  unique  damage  around  RCC  panels  X  and  9  that  was 
not  seen  in  other  areas.  Tiles  from  this  area  also  showed  evi- 
dence of  a  brown  deposit  that  was  not  seen  on  tiles  from  any 


other  part  of  the  Orbiter.  Chemical  analysis  revealed  it  was 
an  Inconel-based  deposit  that  had  come  from  inside  the  RCC 
cavity  on  the  left  wing  (Inconel  is  found  in  wing  leading 
edge  attachment  fittings).  Since  the  streamlines  from  tiles 
with  the  brown  deposit  originate  near  left  RCC  panels  8  and 
9.  this  brown  deposit  likely  originated  as  an  outflow  of  su- 
perheated air  and  molten  metal  from  the  panel  8  and  9  area. 

Molten  Deposits 

High  heat  damage  to  metal  parts  caused  molten  deposits  to 
form  on  some  Orbiter  debris.  Early  analysis  of  these  depos- 
its focused  on  their  density  and  location.  Much  of  the  left 
wing  leading  edge  showed  some  signs  of  deposits,  but  the 
left  wing  RCC  panels  ."S  to  10  had  the  highest  levels. 

Of  all  the  debris  pieces  recovered,  left  wing  panels  8  and 
9  showed  the  largest  amounts  of  deposits.  Significant  but 
lesser  amounts  of  deposits  were  also  observed  on  left  wing 
RCC  panels  5  and  7.  Right  wing  RCC  panel  8  was  the  only 
right-wing  panel  with  significant  deposits. 

Chemical  and  X-Ray  Analysis 

Chemical  analysis  focused  on  recovered  pieces  of  RCC  pan- 
els with  unusual  deposits.  Samples  were  obtained  from  areas 
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in  the  vicinity  of  left  wing  RCC  panel  8  as  well  as  other  left 
and  right  wing  RCC  panels.  Deposits  on  recovered  RCC  de- 
bris were  analyzed  by  cross-sectional  optical  and  scanning 
electron  microscopy,  microprobe  analysis,  and  x-ray  diffrac- 
tion to  determine  the  content  and  layering  of  slag  deposits. 
Slag  was  defined  as  metallic  and  non-metallic  deposits  that 
resulted  from  the  melting  of  the  internal  wing  structures. 
X-ray  analysis  determined  the  best  areas  to  sample  for 
chemical  testing  and  to  see  if  an  overall  flow  pattern  could 
be  discerned. 

The  X-ray  analysis  of  left  wing  RCC  panel  8  (see  Figure 
3.7-7)  showed  a  bottom-to-top  pattern  of  slag  deposits.  In 
some  areas,  small  spheroids  of  heavy  metal  were  aligned 
vertically  on  the  recovered  pieces,  which  indicated  a  super- 
healed  airflow  from  the  bottom  of  the  panel  toward  the  top 
in  the  area  of  RCC  panel  8-left.  These  deposits  were  later 
detemiined  by  cheniical  analysis  to  be  Inconel  718,  prob- 
ably from  the  wing  leading  edge  attachment  fittings  on  the 
spanner  beams  on  RCC  panels  8  and  9.  Computational  fluid 
dynamics  modeling  of  the  flow  behind  panel  8  indicated  that 
the  molten  deposits  would  be  laid  down  in  this  manner. 


Figure  3.7-7.  X-ray  analysis  of  RCC  panel  8-leH  sfiowec/  a  boftom- 
fo-fop  pattern  of  slag  deposits. 


The  layered  deposits  on  panel  8  were  also  markedly  different 
from  those  on  all  other  left-  and  right-wing  panels.  There  was 
much  more  material  deposited  on  RCC  panel  8-left.  These 
deposits  had  a  much  rougher  overall  structure,  including 
rivulets  of  Ccrachrome  slag  deposited  directly  on  the  RCC. 
This  indicated  that  Cerachrome,  the  insulation  that  protects 
the  wing  leading  edge  spar,  was  one  of  the  first  materials  to 
succumb  to  the  superheated  air  entering  through  the  breach  in 
RCC  panel  8-left.  Because  the  melting  temperature  of  Cera- 
chrome is  greater  than  3,200  degrees  Fahrenheit,  analysis  in- 
dicated that  materials  in  this  area  were  exposed  to  extremely 


figure  3.7-8.  Spheroids  of  Inconel  718  and  Cerachrome  were 
deposited  directly  on  the  surface  of  RCC  panel  8-left.  This  slag 
deposit  pattern  was  not  seen  on  any  other  RCC  panels. 


high  temperatures  for  a  long  period.  Spheroids  of  Inconel 
718  were  mixed  in  with  the  Cerachrome.  Because  these 
spheroids  (see  Figure  3.7-8)  were  directly  on  the  surface  of 
the  RCC  and  also  in  the  first  layers  of  deposits,  investigators 
concluded  that  the  Inconel  718  spanner  beam  RCC  fittings 
were  most  likely  the  first  internal  structures  subjected  to 
intense  heating.  No  aluminum  was  detected  in  the  earliest 
slag  layers  on  RCC  panel  8-left.  Only  one  location  on  an  up- 
per corner  piece,  near  the  spar  fitting  attachment,  contained 
A-286  stainless  steel.  This  steel  was  not  present  in  the  bottom 
layer  of  the  slag  directly  on  the  RCC  surface,  which  indicated 
that  the  A-286  attachment  fittings  on  the  wing  spar  were  not 
in  the  direct  line  of  the  initial  plume  impingement. 

In  wing  locations  other  than  left  RCC  panels  8  and  9,  the 
deposits  were  generally  thinner  and  relatively  uniform.  This 
suggests  no  particular  breach  location  other  than  in  left  RCC 
panels  8  and  9.  These  other  slag  deposits  contained  primarily 
aluminum  and  aluminum  oxides  mixed  with  A-286,  Inconel, 
and  Cerachrome,  with  no  consistent  layering.  This  mixing 
of  multiple  metals  in  no  apparent  order  suggests  concurrent 
melting  and  re-depositing  of  all  leading-edge  components, 
which  is  more  consistent  with  post-breakup  damage  than 
the  organized  melting  and  depositing  of  materials  that  oc- 
cun^ed  near  the  original  breach  at  left  RCC  panels  8  and  9. 
RCC  panel  9-left  also  differs  from  the  rest  of  the  locations 
analyzed.  It  was  similar  to  panel  8-left  on  the  inboard  side, 
but  more  like  the  remainder  of  the  samples  analyzed  on  its 
outboard  side.  The  deposition  of  molten  deposits  strongly 
suggests  the  original  breach  occurred  in  RCC  panel  8-left. 

Spanner  Beams,  Fittings,  and  Upper  Carrier  Panels 

Spanner  beams,  fittings,  and  upper  carrier  panels  were  recov- 
ered from  areas  adjacent  to  most  of  the  RCC  panels  on  both 
wings.  However,  significant  numbers  of  these  items  were  not 
recovered  from  the  vicinity  of  left  RCC  panels  6  to  10.  None 
of  the  left  wing  upper  carrier  panels  at  positions  9,  10,  or  1 1 
were  recovered.  No  spanner  beam  parts  were  recovered  from 
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STS-107  Crew  Survivability 


At  the  Board's  request.  NASA  formed  a  Crev\  Survi\abi!it\ 
Working  Group  within  two  weeks  of  the  accident  to  better  un- 
derstand the  cause  of  crew  death  and  the  breakup  of  the  crew 
module.  This  group  made  the  follow  ing  observations. 

Medical  and  Life  Sciences 

The  Working  Group  found  no  irregularities  in  its  extensive  re- 
view of  all  applicable  medical  records  and  crew  health  data.  The 
Armed  Forces  Institute  of  Pathology  and  the  Federal  Bureau  of 
Investigation  conducted  forensic  analyses  on  the  remains  of  the 
crew  of  Colnnihiii  after  they  were  recovered.  It  was  determined 
that  the  acceleration  levels  the  crew  module  experienced  prior 
to  its  catastrophic  failure  were  not  lethal.  The  death  of  the  crew 
members  was  due  to  blunt  trauma  and  hypo.xia.  The  exact  time 
of  death  -  sometime  after  9:()0:19  a.m.  Eastern  Standard  Time 
-  cannot  be  determined  because  of  the  lack  of  direct  physical  or 
recorded  evidence. 

Failure  of  tfie  Crew  Module 

The  forensic  evaluation  of  all  recovered  crew  module/forward 
fuselage  compKinents  did  not  show  any  evidence  of  over-pres- 
surization  or  explosion.  This  conclusion  is  supported  by  both 
the  lack  of  forensic  evidence  and  a  credible  source  for  either 
sort  of  event."  The  failure  of  the  crew  module  resulted  from  the 
thermal  degradation  of  structural  properties,  which  resulted  in  a 
rapid  catastrophic  sequential  structural  breakdown  rather  than 
an  instantaneous  "explosive"  failure. 

Separation  of  the  crew  module/forward  fuselage  assembly  from 
the  rest  of  the  Orbiter  likely  occurred  immediately  in  front  of 
the  payload  bay  (between  Xo376  and  Xo582  bulkheads).  Sub- 
sequent breakup  of  the  assembly  was  a  result  of  ballistic  healing 


and  dynamic  loading.  Evaluations  of  fractures  on  both  primary 
and  secondary  structure  elements  suggest  that  structural  failures 
occurred  at  high  temperatures  and  in  some  cases  at  high  strain 
rates.  An  extensive  trajectory  reconstruction  established  the 
most  likely  breakup  sequence,  shown  below. 

The  load  and  heat  rate  calculations  are  shown  for  the  crew  mod- 
ule along  its  reconstructed  trajectory.  The  band  superimposed 
on  the  trajectory  (starting  about  9:00:58  a.m.  EST)  represents 
the  window  where  all  the  evaluated  debris  originated.  It  ap- 
pears that  the  destruction  of  the  crew  module  took  place  over  a 
period  of  24  seconds  beginning  at  an  altitude  of  approximately 
140,000  feel  and  ending  at  105.000  feet.  These  figures  are 
consistent  with  the  results  of  independent  thermal  re-entry  and 
aerodynamic  models.  The  debris  footprint  proved  consistent 
w  ith  the  results  of  these  trajectory  analyses  and  models.  Ap- 
proximately 40  to  50  percent,  by  weight,  of  the  crew  module 
was  recovered. 

The  Working  Group's  results  significantly  add  to  the  knowledge 
gained  from  the  loss  of  Challenger  in  1986.  Such  knowledge  is 
critical  to  efforts  to  improve  crew  survivability  when  designing 
new  vehicles  and  identifying  feasible  imprcnemenis  to  the  exist- 
ing Orbiters. 

Crew  Worn  Equipment 

Videos  of  the  crew  during  re-entry  that  have  been  made  public 
demonstrate  that  prescribed  procedures  for  use  of  equipment 
such  as  full-pressure  suits,  gloves,  and  helmets  were  not  strictly 
followed.  This  is  confirmed  by  the  Working  Group's  conclu- 
sions that  three  crew  members  were  not  wearing  gloves,  and  one 
was  not  wearing  a  helmet.  However,  under  these  circumstances, 
this  did  not  affect  their  chances  of  survival. 
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Board  Testing 

NASA  and  the  Board  agreed  that  tests  would  be  required  and 
a  test  plan  developed  to  validate  an  impact/breach  scenario. 
Initially,  the  Board  intended  to  act  only  in  an  oversight  role  in 
the  development  and  implementation  of  a  test  plan.  However, 
ongoing  and  continual  1>  unresolved  debate  on  the  si/.e  and 
velocity  of  the  foam  projectile,  largely  due  to  the  Marshall 
Space  Flight  Center's  insistence  that,  despite  overwhelm- 
ing evidence  to  the  contrary,  the  foam  could  have  been  no 
larger  than  855  cubic  inches,  convinced  the  Board  to  take  a 
more  active  role.  Additionally,  in  its  assessment  of  potential 
foam  damage  NASA  continued  to  rely  heavily  on  the  Crater 
model,  v\hich  was  used  during  the  mission  to  determine  that 
the  foam-shedding  event  was  non-threatening.  Crater  is  a 
semi-empirical  model  constructed  from  Apollo-era  data.  An- 
other factor  that  contributed  to  the  Board's  decision  to  play  an 
active  role  in  the  test  program  was  the  Orbiter  Vehicle  Engi- 
neering Working  Group's  requirement  that  the  test  program 
be  used  to  validate  the  Crater  model.  NASA  failed  to  focus 
on  physics-based  pre-test  predictions,  the  schedule  priorities 
for  RCC  tests  that  were  determined  by  transport  analysis,  the 
addition  of  appropriate  test  instrumentation,  and  the  consid- 
eration of  additional  factors  such  as  launch  loads.  Ultimately, 
in  discussions  with  the  Orbiter  Vehicle  Engineering  Working 
Group  and  the  NASA  Accident  Investigation  Team,  the  Board 
provided  test  plan  requirements  that  outlined  the  template  for 
all  testing.  The  Board  directed  that  a  detailed  written  test  plan, 
with  Board-signature  approval,  be  provided  before  each  test. 


gesting  that  the  breach  in  the  RCC  was  through  panel  8-ieft. 
It  is  notewoithy  that  it  occurred  only  in  this  area  and  not 
in  any  other  areas  on  either  the  left  or  the  right  wing  lower 
carrier  panels.  There  is  also  significant  and  unique  evidence 
of  severe  "knife  edges"  erosion  in  left  RCC  panels  8  and  9. 
Lastly,  the  pattern  of  the  debris  field  also  suggests  the  left 
wing  likely  failed  in  the  area  of  RCC  panel  8-left. 

The  preponderance  of  unique  debris  evidence  in  and  near 
RCC  panel  8-left  strongly  suggests  that  a  breach  occurred 
here.  Finally,  the  unique  debris  damage  in  the  RCC  panel 
8-left  area  is  completely  consistent  with  other  data,  such  as 
the  Modular  Au.\iliary  Data  System  recorder,  visual  imagery 
analysis,  and  the  aerodynamic  and  aerothermal  analysis. 

Findings: 

F3.7-I  Multiple  indications  from  the  debris  analysis  es- 
tablish the  point  of  heat  intrusion  as  RCC  panel 
8-left. 

F3.7-2  The  recovery  of  debris  from  the  ground  and  its 
reconstruction  was  critical  to  understanding  the 
accident  scenario. 


Recommendations: 


None 


3.8    Impact  Analysis  AND  Testing 


the  left  RCC  panel  8  to  10  area.  No  upper  or  lower  RCC  fit- 
tings were  recovered  for  left  panels  8.  9,  or  10.  Some  of  this 
debris  may  not  have  been  found  in  the  search,  but  it  is  un- 
likely that  all  of  it  was  missed.  Much  of  this  structure  prob- 
ably melted,  and  was  burned  away  by  superheated  air  inside 
the  wing.  What  did  not  melt  was  so  hot  that  when  it  broke 
apart,  it  did  not  survive  the  heat  of  re-entry.  This  supports  the 
theory  that  superheated  air  penetrated  the  wing  in  the  general 
area  of  RCC  panel  8-left  and  caused  considerable  structural 
damage  to  the  left  wing  leading  edge  spar  and  hardware. 

Debris  Analysis  Conclusions 

A  thorough  analysis  of  left  wing  debris  (independent  of 
the  preceding  aerodynamic,  aerothermal,  sensor,  and  photo 
data)  supports  the  conclusion  that  significant  abnormalities 
occurred  in  the  vicinity  of  left  RCC  panels  8  and  9.  The  pre- 
ponderance of  debris  evidence  alone  strongly  indicates  that 
the  breach  occurred  in  the  bottom  of  panel  8-left.  The  unique 
composition  of  the  slag  found  in  panels  8  and  9,  and  espe- 
cially on  RCC  panel  8-left,  indicates  extreme  and  prolonged 
heating  in  these  areas  very  early  in  re-entry. 

The  early  loss  of  tiles  in  the  region  directly  behind  left  RCC 
panels  8  and  9  also  supports  the  conclusion  that  a  breach 
through  the  wing  leading  edge  spar  occuired  here.  This  al- 
lowed superheated  air  to  flow  into  the  wing  directly  behind 
panel  8.  The  heating  of  the  aluminum  wing  skin  degraded  tile 
adhesion  and  contributed  to  the  early  loss  of  tiles. 

Severe  damage  to  the  lower  earner  panel  9-left  tiles  is 
indicative  of  a  flow  out  of  panel  8-left.  also  strongly  sug- 


The  importance  of  understanding  this  potential  impact  dam- 
age and  the  need  to  prove  or  disprove  the  impression  that 
foam  could  not  break  an  RCC  panel  prompted  the  investi- 
gation to  develop  computer  models  for  foam  impacts  and 
undertake  an  impact-testing  program  of  shooting  pieces  of 
foam  at  a  mockup  of  the  wing  leading  edge  to  re-create,  to 
the  extent  practical,  the  actual  STS-107  debris  impact  event. 

Based  on  imagery  analysis  conducted  during  the  mission 
and  early  in  the  investigation,  the  test  plan  included  impacts 
on  the  lower  wing  tile,  the  left  main  landing  gear  door,  the 
wing  leading  edge,  and  the  carrier  panels. 

A  main  landing  gear  door  assembly  was  the  first  unit  ready 
for  testing.  By  the  time  that  testing  occurred,  however,  anal- 
ysis was  pointing  to  an  impact  site  in  RCC  panels  6  through 
9.  After  the  main  landing  gear  door  tests,  the  analysis  and 
testing  effort  shifted  to  the  wing  leading  edge  RCC  panel  as- 
semblies. The  main  landing  gear  door  testing  provided  valu- 
able data  on  test  processes,  equipment,  and  instrumentation. 
Insignificant  tile  damage  was  observed  at  the  low  impact 
angles  of  less  than  20  degrees  (the  impact  angle  if  the  foam 
had  struck  the  main  landing  gear  door  would  have  been 
roughly  five  degrees).  The  apparent  damage  threshold  was 
consistent  with  previous  testing  with  much  smaller  projec- 
tiles in  1999,  and  with  independent  modeling  by  Southwest 
Research  Institute.  (See  Appendix  D.  12.) 

Impact  Test  -  Wing  Leading  Edge  Panel  Assemblies 

The  test  concept  was  to  impact  flightworthy  wing  leading 
edge  RCC  panel  assemblies  w  ith  a  foam  projectile  fired  by 
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a  compressed-gas  gun.  Target  panel  assemblies  with  a  flight 
history  similar  to  Coliinihia's  would  be  mounted  on  a  sup- 
port that  was  structurally  equivalent  to  CohnnbUi?.  wing. 
The  attaching  hardware  and  fittings  would  be  either  flight 
certified  or  built  to  Colwnhia  drawings.  Several  consider- 
ations influenced  the  overall  RCC  test  design: 

•  RCC  panel  assemblies  were  limited,  particularly  those 
with  a  flight  history  similar  to  Colitnihki'f,. 

•  The  basic  material  properties  of  new  RCC  were  known 
to  be  highly  variable  and  were  not  characterized  for  high 
strain  rate  loadings  typical  of  an  impact. 

•  The  influence  of  aging  was  uncertain. 

•  The  RCC's  brittleness  allowed  only  one  test  impact  on 
each  panel  to  avoid  the  possibility  that  hidden  damage 
would  influence  the  results  of  later  impacts. 

•  The  structural  system  response  of  RCC  components, 
their  support  hardware,  and  the  wing  structure  was 
complex. 

•  The  foam  projectile  had  to  be  precisely  targeted,  be- 
cause the  predicted  structural  response  depended  on  the 
impact  point. 

Because  of  these  concerns,  engineering  tests  with  fiberglass 
panel  assemblies  from  the  first  Orbiter,  Enterprise.^-  were 
used  to  obtain  an  understanding  of  overall  system  response 
to  various  impact  angles,  locations,  and  foam  orientations. 
The  fiberglass  panel  impact  tests  were  used  to  confirm  in- 
strumentation design  and  placement  and  the  adequacy  of  the 
overall  test  setup. 

Test  projectiles  were  made  from  the  same  type  of  foam  as 
the  bipod  ramp  on  STS-107's  External  Tank.  The  projectile's 
mass  and  velocity  were  determined  by  the  previously  de- 
scribed "best  fit"  image  and  transport  analyses.  Because  the 
precise  impact  point  was  estimated,  the  aiming  point  for  any 
individual  test  panel  was  based  on  structural  analyses  to 
maximize  the  loads  in  the  area  being  assessed  without  pro- 
ducing a  spray  of  foam  over  the  top  of  the  wing.  The  angle 
of  impact  relative  to  the  test  panel  was  determined  from 


the  transport  analysis  of  the  panel  being  tested.  The  foam's 
rotational  velocity  was  accounted  for  with  a  three-degree 
increase  in  the  impact  angle. 

Computer  Modeling  of  Impact  Tests 

The  investigation  used  sophisticated  computer  models  to 
analyze  the  foam  impact  and  to  help  develop  an  impact  test 
program.  Because  an  exhaustive  test  matrix  to  cover  all  fea- 
sible impact  scenarios  was  not  practical,  these  models  were 
especially  important  to  the  investigation. 

The  investigation  impact  modeling  team  included  members 
from  Boeing,  Glenn  Research  Center,  .Johnson  Space  Cen- 
ter, Langley  Research  Center,  Marshall  Space  Flight  Center. 
Sandia  National  Laboratory,  and  Stellingwerf  Consulting. 
The  Board  also  contracted  with  Southwest  Research  Insti- 
tute to  peiform  independent  computer  analyses  because  of 
the  institute's  extensive  test  and  analysis  experience  with 
ballistic  impacts,  including  work  on  the  Orbiter's  Thermal 
Protection  System.  (Appendix  D.12  provides  a  complete 
description  of  Southwest's  impact  modeling  methods  and 
results.) 

The  objectives  of  the  modeling  effort  included  ( 1 )  evalua- 
tion of  test  instrumentation  requirements  to  provide  test  data 
with  which  to  calibrate  the  computer  models,  (2)  prediction 
of  stress,  damage,  and  instrumentation  response  prior  to  the 
Test  Readiness  Reviews,  and  (3)  determination  of  the  flight 
conditions/loads  (vibrations,  aerodynamic,  inertial,  acoustic, 
and  themial)  to  include  in  the  tests.  In  addition,  the  impact 
modeling  team  provided  information  about  foam  impact  lo- 
cations, orientation  at  impact,  and  impact  angle  adjustments 
that  accounted  for  the  foam's  rotational  velocity. 

Flight  Environment 

A  comprehensive  consideration  of  the  Shuttle's  flight  en- 
vironment, including  temperature,  pressure,  and  vibration, 
was  required  to  establish  the  experimental  protocol. 


Figure  3.8?    Nitrogen-powered  gun  at  the  Southwest  Research  Institute  used  for  the  test  series. 
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Based  on  the  results  of  Glenn  Research  Center  sub-scale  im- 
pact tests  of  how  various  foam  temperatures  and  pressures 
influence  the  impact  force,  the  Board  found  that  full-scale 
impact  tests  with  foam  at  room  temperature  and  pressure 
could  adequately  simulate  the  conditions  during  the  foam 
strike  on  STS- 107." 

The  structure  of  the  foam  complicated  the  testing  process. 
The  bipod  ramp  foam  is  hand-sprayed  in  layers,  which  cre- 
ates "knit  lines,"  the  boundaries  between  each  layer,  and  the 
foam  compression  characteristics  depend  on  the  knit  lines' 
orientation.  The  projectiles  used  in  the  full-scale  impact  tests 
had  knit  lines  consistent  with  those  in  the  bipod  ramp  foam. 

.\  primary  concern  of  investigators  was  that  external  loads 
present  in  the  flight  environment  might  add  substantial  extra 
force  to  the  left  wing.  However,  analysis  demonstrated  that 
the  only  significant  external  loads  on  the  wing  leading  edge 
structural  subsystem  at  about  82  seconds  into  flight  are  due 
to  random  vibration  and  the  pressure  differences  inside  and 
outside  the  leading  edge.  The  Board  concluded  that  the  flight 
environment  stresses  in  the  RCC  panels  and  the  attachment 
fittings  could  be  accounted  for  in  post-impact  analyses  if 
necessary.  However,  the  dramatic  damage  produced  by  the 
impact  tests  demonstrated  that  the  foam  strike  could  breach 
the  wing  leading  edge  structure  subsystein  independent  of 
any  stresses  associated  with  the  flight  environment.  (Appen- 
dix D.  12  contains  more  detail.) 

Test  Assembly 

The  impact  tests  were  conducted  at  a  Southwest  Research 
Institute  facility.  Figure  3.8- 1  shows  the  nitrogen  gas  gun  that 
had  evaluated  bird  strikes  on  aircraft  fuselages.  The  gun  was 
modified  to  accept  a  33-foot-long  rectangular  barrel,  and  the 
target  site  was  equipped  with  sensors  and  high-speed  camer- 
as that  photographed  2,000  to  7,0(X)  frames  per  second,  with 
intense  light  provided  by  theater  spotlights  and  the  sun. 

Test  Impact  Target 

The  leading  edge  structural  subsystem  test  target  was  designed 
to  accommodate  the  Board's  evolving  determination  of  the 


most  likely  point  of  impact.  Initially,  analysis  pointed  to  the 
main  landing  gear  door.  As  the  imaging  and  transport  teams 
refined  their  assessments,  the  likely  strike  zone  narrowed  to 
RCC  panels  6  through  9.  Because  of  the  long  lead  time  to  de- 
velop and  produce  the  large  complex  test  assemblies,  inves- 
tigators developed  an  adaptable  test  assembly  (Figure  3.8-2) 
that  would  provide  a  structurally  similar  mounting  for  RCC 
panel  assemblies  5  to  10  and  would  accommodate  some  200 
sensors,  including  high-speed  cameras,  strain  and  deflection 
gauges,  accelerometers,  and  load  cells. '^ 

Test  Panels 

RCC  panels  6  and  9,  which  bracketed  the  likely  impact  re- 
gion, were  the  first  identified  for  testing.  They  would  also 
permit  a  comparison  of  the  structural  response  of  panels  with 
and  without  the  additional  thickness  at  certain  locations. 

Panel  6  tests  demonstrated  the  complex  system  response  to 
impacts.  While  the  initial  focus  of  the  investigation  had  been 
on  single  panel  response,  early  results  from  the  tests  with 
fiberglass  panels  hinted  at  "boundary  condition"  effects. 
Instruments  measured  high  stresses  through  panels  6,  7,  and 
8.  With  this  in  mind,  as  well  as  forensic  and  sensor  evidence 
that  panel  8  was  the  likeliest  location  of  the  foam  strike,  the 
Board  decided  that  the  second  RCC  test  should  target  panel 
8,  which  was  placed  in  an  assembly  that  included  RCC  pan- 
els 9  and  10  to  provide  high  fidelity  boundary  conditions. 
The  decision  to  impact  test  RCC  panel  8  was  complicated 
by  the  lack  of  spare  RCC  components. 

The  specific  RCC  panel  assemblies  selected  for  testing 
had  flight  histories  similar  to  that  of  STS- 107,  which  was 
Coltiinhia'f,  28th  flight.  Panel  6  had  flown  30  missions  on 
Di.scovcry.  and  Panel  8  had  flown  26  missions  on  Atlantis. 

Test  Projectile 

The  preparation  of  BX-250  foam  test  projectiles  used  the 
same  material  and  preparation  processes  that  produced  the 
foam  bipod  ramp.  Foam  was  selected  as  the  projectile  mate- 
rial because  foam  was  the  most  likely  debris,  and  materials 
other  than  foam  would  represent  a  greater  threat. 


Figure  3.8-2.  Test  assembly  thai  provided  a  sfrucfural  mounfing 
for  RCC  panel  assemblies  5  io  10  and  would  accommodafe  some 
200  sensors  and  other  test  equipment. 


Figure  3.8-3  A  typical  foam  projectile,  which  has  marks  for  de- 
termining position  and  velocity  as  well  as  blackened  outlines  for 
indicating  the  impact  footprint. 
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The  testing  required  a  projectile  (see  Figure  3.8-3)  made 
from  standard  stock,  so  investigators  selected  a  rectangular 
cross-section  of  11.5  by  5.5  inches,  which  was  within  15 
percent  of  the  footprint  of  the  mean  debris  size  initially  esti- 
mated by  image  analysis.  To  account  for  the  foam's  density, 
the  projectile  length  was  cut  to  weigh  1.67  pounds,  a  figure 
determined  by  image  and  transport  analysis  to  best  repre- 
sent the  STS-107  projectile.  For  foam  with  a  density  of  2.4 
pounds  per  cubic  foot,'^  the  projectile  dimensions  were  19 
inches  by  1 1 .5  inches  by  5.5  inches. 

Impact  Angles 

The  precise  impact  location  of  the  foam  determined  the  im- 
pact angle  because  the  debris  was  moving  almost  parallel  to 
the  Orbiter's  fuselage  at  impact.  Tile  areas  would  have  been 
hit  at  vei7  small  angles  (approximately  five  degrees),  but 
the  curvature  of  the  leading  edge  created  angles  closer  to  20 
degrees  (see  Figure  3.4-4). 

The  foam  that  struck  Coliiinhiu  on  January  16,  2003.  had 
both  a  translational  speed  and  a  rotational  speed  relative  to 
the  Orbiter.  The  translational  velocity  was  easily  replicated 
by  adjusting  the  gas  pressure  in  the  gun.  The  rotational  en- 
ergy could  be  calculated,  but  the  impact  force  depends  on 
the  material  composition  and  properties  of  the  impacting 
body  and  how  the  rotating  body  struck  the  wing.  Because 
the  details  of  the  foam  contact  were  not  available  from  any 
visual  e\idence.  analysis  estimated  the  increase  in  impact 
energy  that  would  be  imparted  by  the  rotation.  These  analy- 
ses resulted  in  a  three-degree  increase  in  the  angle  at  which 
the  foam  test  projectile  would  hit  the  test  panel.'" 

The  "clocking  angle"  was  an  additional  consideration.  As 
shown  in  Figure  3.8-4,  the  gun  barrel  could  be  rotated  to 
change  the  impact  point  of  the  foam  projectile  on  the  leading 
edge.  Investigators  conducted  experiments  to  determine  if 
the  comer  of  the  foam  block  or  the  full  edge  would  impart  a 


greater  force.  During  the  fiberglass  tests,  it  was  found  that  a 
clocking  angle  of  30  degrees  allowed  the  1 1 .5-inch-edge  to 
fully  contact  the  panel  at  impact,  resulting  in  a  greater  local 
force  than  a  zero  degree  angle,  which  was  achieved  with  the 
barrel  aligned  vertically.  A  zero-degree  angle  was  used  for 
the  test  on  RCC  panel  6,  and  a  30-degree  angle  was  used  for 
RCC  panel  8. 

Test  Results  from  Fiberglass  Panel  Tests  1-5 

Five  engineering  tests  on  fiberglass  panels  (see  Figure  3.8-5) 
established  the  test  parameters  of  the  impact  tests  on  RCC 
panels.  Details  of  the  fiberglass  tests  are  in  Appendix  D.  12. 
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Figure  3  8-4.  7/ie  barrel  on  fhe  nitrogen  gun  could  be  rotated  to 
adjust  the  impact  point  of  the  foam  projectile. 


Figure  3.8-5.  A  typical  foam  strike  leaves  impact  streaks,  and  the 
foam  projectile  breaks  into  shards  and  larger  pieces  tiere  the 
foam  is  striking  Panel  6  on  a  fiberglass  test  article. 


Test  Results  from  Reinforced  Carbon-Carbon  Panel  6 
(From  Discovery) 

RCC  panel  6  was  tested  first  to  begin  to  establish  RCC 
impact  response,  although  by  the  time  of  the  test,  other 
data  had  indicated  that  RCC  panel  8-left  was  the  most 
likely  site  of  the  breach.  RCC  panel  6  was  impacted  us- 
ing the  same  parameters  as  the  test  on  fiberglass  panel  6 
and  developed  a  5.5-inch  crack  on  the  outboard  end  of  the 
panel  that  extended  through  the  rib  (see  Figure  3.8-6).  There 
was  also  a  crack  through  the  "web"  of  the  T-seal  between 
panels  6  and  7  (see  Figure  3.8-7).  As  in  the  fiberglass  test, 
the  foam  block  deflected,  or  moved,  the  face  of  the  RCC 
panel,  creating  a  slit  between  the  panel  and  the  adjacent 
T-seal,  which  ripped  the  projectile  and  stuffed  pieces  of  foam 
into  the  slit  (see  Figure  3.8-8).  The  panel  rib  failed  at  lower 
stresses  than  predicted,  and  the  T-seal  failed  closer  to  predic- 
tions, but  overall,  the  stress  pattern  was  similar  to  what  was 
predicted,  demonstrating  the  need  to  incorporate  more  com- 
plete RCC  failure  criteria  in  the  computational  models. 

Without  further  crack  growth,  the  specific  structural  dam- 
age this  test  produced  would  probably  not  have  allowed 
enough  superheated  air  to  penetrate  the  wing  during  re-entry 
to  cause  serious  damage.  However,  the  test  did  demonstrate 
that  a  foam  impact  representative  of  the  debris  strike  at  81.9 
seconds  after  launch  could  damage  an  RCC  panel.  Note  that 
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Figure  3.8-6.  A  5.5-inch  crack  on  the  outboard  portion  of  RCC 
Panel  6  during  testing. 


Figure  3.8-7.   Two  views  of  the  crack  in  the  T-seal  between  RCC 
Panels  6  and  7. 


the  RCC  panel  6-let't  test  used  fiberglass  panels  and  T-seals  in 
panel  7,  8, 9,  and  10  locations.  As  seen  later  in  the  RCC  panel 
8-ieft  test,  this  test  configuration  may  not  have  adequately 
reproduced  the  flight  configuration.  Testing  of  a  .full  RCC 
panel  6,  7,  and  8  configuration  might  have  resulted  in  more 
severe  damage. 

Test  Results  from  Reinforced  Carbon-Carbon  Panel  8 
(From  Atlantis) 

The  second  impact  test  of  RCC  material  used  panel  8  from 
Atlantis,  which  had  flown  26  missions.  Based  on  forensic 
evidence,  sensor  data,  and  aerothermal  studies,  panel  8  was 
considered  the  most  likely  point  of  the  foam  debris  impact 
on  Cohiiuhia. 

Based  on  the  system  response  of  the  leading  edge  in  the 
fiberglass  and  RCC  panel  6  impact  tests,  the  adjacent  RCC 
panel  assemblies  (9  and  10)  were  also  flown  hardware.  The 
reference  1.67-pound  foam  test  projectile  impacted  panel  8 


Figure  3.8-8.  Two  views  of  foam  lodged  into  the  slit  during  tests. 


Figure  3.8-9.  The  large  impact  hole  in  Panel  8  from  the  fmal  test. 


Figure  3.8-10.  Numerous  cracks  were  also  noted  in  RCC  Panel  8. 
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at  777  feet  per  second  with  a  clocking  angle  of  30  degrees 
and  an  angle  of  incidence  of  25. 1  degrees. 

The  impact  created  a  hole  roughly  16  inches  by  17  inches, 
which  was  within  the  range  consistent  with  all  the  findings 
of  the  investigation  (see  Figure  3.8-9).  Additionally,  cracks 
in  the  panel  ranged  up  to  1 1  inches  in  length  (Figure  3.8-10). 
The  T-seal  between  panels  8  and  9  also  failed  at  the  lower 
outboard  mounting  lug. 

Three  large  pieces  of  the  broken  panel  face  sheet  (see  Fig- 
ure 3.8-11)  were  retained  within  the  wing.  The  two  largest 
pieces  had  surface  areas  of  86  and  75  square  inches.  While 
this  test  cannot  exactly  duplicate  the  damage  Coliinihia  in- 
curred, pieces  such  as  these  could  have  remained  in  the  wing 
cavity  for  some  time,  and  could  then  have  floated  out  of  the 
damaged  wing  while  the  Orbiter  was  maneuvering  in  space. 
This  scenario  is  consistent  with  the  event  observed  on  Flight 
Day  2  (see  Section  3.5). 

The  test  clearly  demonstrated  that  a  foam  impact  of  the  type 
Columbia  sustained  could  seriously  breach  the  Wing  Lead- 
ing Edge  Structural  Subsystem. 

Conclusion 

At  the  beginning  of  this  chapter,  the  Board  stated  that  the 
physical  cause  of  the  accident  was  a  breach  in  the  Thermal 
Protection  System  on  the  leading  edge  of  the  left  wing.  The 
breach  was  initiated  by  a  piece  of  foam  that  separated  from 
the  left  bipod  ramp  of  the  External  Tank  and  struck  the  wing 
in  the  vicinity  of  the  lower  half  of  the  Reinforced  Carbon- 
Carbon  (RCC)  panel  8. 

The  conclusion  that  foam  separated  from  the  External  Tank 
bipod  ramp  and  struck  the  wing  in  the  vicinity  of  panel  8  is 
documented  by  photographic  evidence  (Section  3.4).  Sensor 
data  and  the  aerodynamic  and  thermodynamic  analyses  (Sec- 
tion 3.6)  based  on  that  data  led  to  the  determination  that  the 
breach  was  in  the  vicinity  of  panel  8  and  also  accounted  for 
the  subsequent  melting  of  the  supporting  structure,  the  spar, 
and  the  wiring  behind  the  spar  that  occurred  behind  panel 
8.  The  detailed  examination  of  the  debris  (Section  3.7)  also 
pointed  to  panel  8  as  the  breach  site.  The  impact  tests  (Sec- 
tion 3.8)  established  that  foam  can  breach  the  RCC,  and  also 
counteracted  the  lingering  denial  or  discounting  of  the  ana- 
lytic evidence.  Based  on  this  evidence,  the  Board  concluded 
that  panel  8  was  the  site  of  the  foam  strike  to  Colionhia 
during  the  liftoff  of  STS- 107  on  January  23,  2003. 

Findings: 

F3.8-1  The  impact  test  program  demonstrated  that  foam 
can  cau.se  a  wide  range  of  impact  damage,  from 
cracks  to  a  16-  by  17-inch  hole. 

F3.8-2  The  wing  leading  edge  Reinforced  Carbon-Car- 
bon composite  material  and  associated  support 
hardware  are  remarkably  tough  and  have  impact 
capabilities  that  far  exceed  the  minimal  impact 
resistance  specified  in  their  original  design  re- 
quirements. Nevertheless,  these  tests  demonstrate 
that  this  inherent  toughness  can  be  exceeded  by 


impacts  representative  of  those  that  occurred  dur- 
ing Columbia's  ascent. 

F3.8-3  The  response  of  the  wing  leading  edge  to  impacts 
is  complex  and  can  vai^  greatly,  depending  on  the 
location  of  the  impact,  projectile  mass,  orienta- 
tion, composition,  and  the  material  properties  of 
the  panel  assembly,  making  analytic  predictions 
of  damage  to  RCC  assemblies  a  challenge." 

F3.8-4  Testing  indicates  the  RCC  panels  and  T-seals 
have  much  higher  impact  resistance  than  the  de- 
sign specifications  call  for. 

F3.8-5  NASA  has  an  inadequate  number  of  spare  Rein- 
forced Carbon-Carbon  panel  assemblies. 

F3.8-6  NASA's  current  tools,  including  the  Crater  mod- 
el, are  inadequate  to  evaluate  Orbiter  Thermal 
Protection  System  damage  from  debris  impacts 
during  pre-launch,  on-orbit,  and  post-launch  ac- 
tivity. 

F3.8-7  The  bipod  ramp  foam  debris  critically  damaged 
the  leading  edge  of  Columbia's  left  wing. 

Recommendations: 

R3.8-I  Obtain  sufficent  spare  Reinforced  Carbon-Car- 
bon panel  assemblies  and  associated  support 
components  to  ensure  that  decisions  related  to 
Reinforced  Carbon-Carbon  maintenance  are 
made  on  the  basis  of  component  specifications, 
free  of  external  pressures  relating  to  schedules, 
costs,  or  other  considerations. 

R3.8-2  Develop,  validate,  and  maintain  physics-based 
computer  models  to  evaluate  Thermal  Protection 
System  damage  from  debris  impacts.  These  tools 
should  provide  realistic  and  timely  estimates  of 
any  impact  damage  from  possible  debris  from 
any  .source  that  may  ultimately  impact  the  Or- 
biter. Establish  impact  damage  thresholds  that 
trigger  responsive  corrective  action,  such  as  on- 
orbit  inspection  and  lepair.  when  indicated. 


Figure  3.8-11.   Three  large  pieces  of  debris  from  the  panel  face 
sheet  were  lodged  withm  the  hollow  area  behind  the  RCC  panel. 
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Endnotes  for  Chapter  3 


The  citations  that  contain  a  reference  to  "CAIB  document"  with  CAB  or 
CTF  followed  by  seven  to  eleven  digits,  such  as  CABOOl-0010,  refer  to  a 
document  in  the  Columbia  Accident  Investigation  Board  database  maintained 
by  the  Department  of  Justice  and  archived  at  the  National  Archives. 


See  Dennis  R.  Jenkins,  Space  Shuffle:  The  History  of  the  Nationo/  Spoce 
Transportation  System  -  The  First  100  Missions  (Cape  Canaveral,  FL, 
Specialty  Press,  2001),  pp.  421-424  for  a  complete  description  of  the 
External  Tank. 

Scotty  Sparks  and  Lee  Foster,  "ET  Cryoinsulotion,"  CAIB  Public  Hearing, 
April  7,  2003.  CAIB  document  CAB017-03140371. 

Scotty  Sparks  and  Steve  Holmes,  Presentation  to  the  CAIB,  March  27, 
2003,  CAIB  document  CTF036-02000200. 

See  the  CAIB/NAIT  Joint  Working  Scenario  in  Appendix  D.7  of  Volume 
II  of  this  report. 

Boeing  Specification  MJ070-0001-1E,  "Orbiter  End  Item  Specification  for 
the  Space  Shuttle  Systems,  Part  1,  Performance  and  Design  Requirements, 
November  7,  2002. 

Ibid.,  Paragraph  3.3.1.8.16. 

NSTS-08171,  "Operations  and  Maintenance  Requirements  and 
Specifications  Document  (OMRSD)"  File  II,  Volume  3.  CAIB  document 
CAB03312821997 

Dr.  Gregory  J.  Byrne  and  Dr.  Cynthia  A.  Evans,  "STS-107  Image  Analysis 
Team  Final  Report  in  Support  of  the  Columbia  Accident  Investigation," 
NSTS-37384,  June  2003.  CAIB  document  CTF076- 155 11657  See 
Appendix  E.2  for  a  copy  of  the  report. 

R.  J.  Gomex  et  ol,  "STS-107  Foam  Transport  Final  Report,"  NSNS- 
60506,  August  2003. 


This  section  based  on  information  from  the  following  reports:  MIT  Lincoln 
Laboratory  "Report  on  Flight  Day  2  Object  Analysis,"  Dr.  Brian  M. 
Kent,  Dr.  Kueichien  C.  Hill,  and  Captain  John  Gulick,  "An  Assessment 
of  Potential  Materiol  Candidates  for  the  'Flight  Day  2'  Radar  Object 
Observed  During  the  NASA  Mission  STS-107  (Columbia)",  Air  Force 
Research  Laboratory  Final  Summary  Report  AFRL-SNS-2003-001,  July 
20,  2003  (see  Appendix  E.2);  Multiple  briefings  to  the  CAIB  from  Dr. 
Brian  M.  Kent,  AFRL/SN  (CAIB  document  CTF076-19782017);  Briefing 
to  the  CAIB  from  HQ  AFSPC/XPY,  April  18,  2003  (CAIB  document 
CAB066-13771388). 

The  water  tanks  from  below  the  mid-deck  floor,  along  with  both  Forward 
Reaction  Control  System  propellant  tanks  were  recovered  in  good 
condition. 

Enterprise  was  used  for  the  initial  Approach  and  Landing  Tests  and 
ground  tests  of  the  Orbiter,  but  was  never  used  for  orbital  tests.  The 
vehicle  is  now  held  by  the  Notional  Air  and  Space  Museum.  See  Jenkins, 
Space  Shuffle,  pp.  205-223,  for  more  information  on  Enterprise. 

Philip  Kopfinger  and  Wanda  Sigur,  "Impact  Test  Results  of  BX-250  In 
Support  of  the  Columbia  Accident  Investigation,"  ETTP-MS-03-021,  July 
17,  2003. 

Details  of  the  test  instrumentation  ore  in  Appendix  D.12. 

Evaluations  of  the  adjustments  in  the  angle  of  incidence  to  account  for 
rotation  ore  in  Appendix  D.12. 

The  potential  damage  estimates  had  great  uncertainty  because  the 
database  of  bending,  tension,  crushing,  and  other  measures  of  failure 
were  incomplete,  particularly  for  RCC  material. 
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Chapter  4 


Other  Factors  Considered 


During  its  investigation,  the  Board  evaluated  every  known 
factor  that  could  have  caused  or  contributed  to  the  Coliini- 
hia  accident,  such  as  the  effects  of  space  weather  on  the 
Orbiter  during  re-entry  and  the  specters  of  sabotage  and 
terrorism.  In  addition  to  the  analysis/scenario  investiga- 
tions, the  Board  oversaw  a  NASA  "fault  tree"  investiga- 
tion, which  accounts  for  every  chain  of  events  that  could 
possibly  cause  a  system  to  fail.  Most  of  these  factors  were 
conclusively  eliminated  as  having  nothing  to  do  with  the 
accident;  however,  several  factors  have  yet  to  be  ruled  out. 
Although  deemed  by  the  Board  as  unlikely  to  have  con- 
tributed to  the  accident,  these  are  still  open  and  are  being 
investigated  further  by  NASA.  In  a  few  other  cases,  there 
is  insufficient  evidence  to  completely  eliminate  a  factor, 
though  most  evidence  indicates  that  it  did  not  play  a  role  in 
the  accident.  In  the  course  of  investigating  these  factors,  the 
Board  identified  several  serious  problems  that  were  not  pail 
of  the  accident's  causal  chain  but  nonetheless  have  major 
implications  for  future  missions. 

In  this  chapter,  a  discussion  of  these  potential  causal  and 
contributing  factors  is  divided  into  two  sections.  The  first 
introduces  the  primary  tool  used  to  assess  potential  causes 
of  the  breakup:  the  fault  tree.  The  second  addres.ses  fault 
tree  items  and  particularly  notable  factors  that  raised  con- 
cerns for  this  investigation  and.  more  broadly,  for  the  future 
operation  of  the  Space  Shuttle. 

4.1     Fault  Tree 

The  NAS.'X  Accident  Investigation  Team  investigated  the 
accident  using  "fault  trees,"  a  common  organizational  tool 
in  systems  engineering.  Fault  trees  are  graphical  represei'- 
tations  of  every  conceivable  sequence  of  events  that  could 
cause  a  system  to  fail.  The  fault  tree's  uppermost  level 
illustrates  the  events  that  could  have  directly  caused  the  loss 
of  Coliinihici  by  aerodynamic  breakup  during  re-entry.  Subse- 
quent levels  comprise  all  individual  elements  or  factors  that 
could  cause  the  failure  described  immediately  above  it.  In 
this  way,  all  potential  chains  of  causation  that  lead  ultimately 
to  the  loss  of  Coliinihid  can  be  diagrammed,  and  the  behavior 
of  every  subsystem  that  was  not  a  precipitating  cause  can  be 
eliminated  from  consideration.  Figure  4.1-1  depicts  the  fault 
tree  structure  for  the  Cohinihici  accident  investigation. 


^ 


^ 
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Figure  4.?-].  Accident  investigation  fault  tree  structure. 


NASA  chartered  six  teams  to  develop  fault  trees,  one  for  each 
of  the  Shuttle's  major  components:  the  Orbiter,  Space  Shuttle 
Main  Engine,  Reusable  Solid  Rocket  Motor,  Solid  Rocket 
Booster,  External  Tank,  and  Payload.  A  seventh  "systems 
integration"  fault  tree  team  analyzed  failure  scenarios  involv- 
ing two  or  more  Shuttle  components.  These  interdisciplinary 
teams  included  NASA  and  contractor  personnel,  as  well  as 
outside  experts. 

Some  of  the  fault  trees  are  very  large  and  intricate.  For  in- 
stance, the  Orbiter  fault  tree,  which  only  considers  events 
on  the  Orbiter  that  could  have  led  to  the  accident,  includes 
234  elements.  In  contrast,  the  Systems  Integration  fault  tree, 
which  deals  with  interactions  among  parts  of  the  Shuttle, 
includes  29.5  unique  multi-element  integration  faults,  128 
Orbiter  multi-element  faults,  and  22 1  connections  to  the  other 
Shuttle  components.  These  faults  fall  into  three  categories: 
induced  and  natural  environments  (such  as  structural  inter- 
face loads  and  electromechanical  elfects);  integrated  vehicle 
mass  properties;  and  external  impacts  (such  as  debris  from  the 
External  Tank).  Because  the  Systems  Integration  team  consid- 
ered multi-element  faults  -  that  is,  .scenarios  involving  several 
Shuttle  components  -  it  frequently  worked  in  tandem  with  the 
Component  teams. 
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In  the  case  of  the  Cohiinhia  accident,  there  could  be  two 
plausible  explanations  for  the  aerodynamic  breakup  of  the 
Orbiter:  ( 1 )  the  Orbiter  sustained  structural  damage  that  un- 
dermined attitude  control  during  re-entry;  or  (2)  the  Orbiter 
maneuvered  to  an  attitude  in  which  it  was  not  designed  to 
fly.  The  former  explanation  deals  with  structural  damage 
initiated  before  launch,  during  ascent,  on  orbit,  or  during 
re-entry.  The  latter  considers  aerodynamic  breakup  caused 
by  improper  attitude  or  trajectory  control  by  the  Orbiter's 
Flight  Control  System.  Telemetry  and  other  data  strongly 
suggest  that  improper  maneuvering  was  not  a  factor.  There- 
fore, most  of  the  fault  tree  analysis  concentrated  on  struc- 
tural damage  that  could  have  impeded  the  Orbiter's  attitude 
control,  in  spite  of  properly  operating  guidance,  navigation, 
and  flight  control  systems. 

When  investigators  ruled  out  a  potential  cascade  of  events, 
as  represented  by  a  branch  on  the  fault  tree,  it  was  deemed 
"closed."  When  evidence  proved  inconclusive,  the  item  re- 
mained "open."  Some  elements  could  be  dismissed  at  a  high 
level  in  the  tree,  but  most  required  delving  into  lower  levels. 
An  intact  Shuttle  component  or  system  (for  example,  a  piece 
of  Orbiter  debris)  often  provided  the  basis  for  closing  an  ele- 
ment. Telemetry  data  can  be  equally  persuasive:  it  frequently 
demonstrated  that  a  system  operated  correctly  until  the  loss 
of  signal,  providing  strong  evidence  that  the  system  in  ques- 
tion did  not  contribute  to  the  accident.  The  same  holds  true 
for  data  obtained  from  the  Modular  Auxiliary  Data  System 
recorder,  which  was  recovered  intact  after  the  accident. 

The  closeout  of  particular  chains  of  causation  was  exam- 
ined at  various  stages,  culminating  in  reviews  by  the  NASA 
Orbiter  Vehicle  Engineering  Working  Group  and  the  NASA 
Accident  Investigation  Team.  After  these  groups  agreed 
to  close  an  element,  their  findings  were  forwarded  to  the 
Board  for  review.  At  the  time  of  this  report's  publication, 
the  Bpard  had  closed  more  than  one  thousand  items.  A  sum- 
mary of  fault  tree  elements  is  listed  in  Figure  4. 1  -2. 


Branch 

lotal 

Number 

of  Elements 

Number  of  Open  Elements 

Likely 

Possible 

Unlikely 

Orbiter 

234 

3 

8 

6 

SSME 

22 

0 

0 

0 

RSRM 

35 

0 

0 

0 

SRB 

88 

0 

4 

4 

ET 

883 

6 

0 

135 

Payload 

3 

0 

0 

0 

Integration 

295 

1 

0 

1 

Figure  4.1-2.    Summary  of  fault  tree  elements  reviewed  by  the 
Board. 


The  open  elements  are  grouped  by  their  potential  for  con- 
tributing either  directly  or  indirectly  to  the  accident.  The  first 
group  contains  elements  that  may  have  in  any  way  contrib- 


uted to  the  accident.  Here,  "contributed"  means  that  the  ele- 
ment may  have  been  an  initiating  event  or  a  likely  cause  of 
the  accident.  The  second  group  contains  elements  that  could 
not  be  closed  and  may  or  may  not  have  contributed  to  the 
accident.  These  elements  are  possible  causes  or  factors  in 
this  accident.  The  third  group  contains  elements  that  could 
not  be  closed,  but  are  unlikely  to  have  contributed  to  the  ac- 
cident. Appendix  D.3  lists  all  the  elements  that  were  closed 
and  thus  eliminated  from  consideration  as  a  cause  or  factor 
of  this  accident. 

Some  of  the  element  closure  efforts  will  continue  after  this 
report  is  published.  Some  elements  will  never  be  closed,  be- 
cause there  is  insufficient  data  and  analysis  to  uncondition- 
ally conclude  that  they  did  not  contribute  to  the  accident.  For 
instance,  heavy  rain  fell  on  Kennedy  Space  Center  prior  to 
the  launch  of  STS-107.  Could  this  abnormally  heavy  rainfall 
have  compromised  the  External  Tank  bipod  foam?  Experi- 
ments showed  that  the  foam  did  not  tend  to  absorb  rain,  but 
the  rain  could  not  be  ruled  out  entirely  as  having  contributed 
to  the  accident.  Fault  tree  elements  that  were  not  closed  as  of 
publication  are  listed  in  Appendix  D.4. 

4.2    Remaining  Factors 

Several  significant  factors  caught  the  attention  of  the  Board 
during  the  investigation.  Although  it  appears  that  they  were 
not  causal  in  the  STS-107  accident,  they  are  presented  here 
for  completeness. 

Solid  Rocket  Booster  Bolt  Catchers 

The  fault  tree  review  brought  to  light  a  significant  problem 
with  the  Solid  Rocket  Booster  bolt  catchers.  Each  Solid 
Rocket  Booster  is  connected  to  the  External  Tank  by  four 
separation  bolts:  three  at  the  bottom  plus  a  larger  one  at  the 
top  that  weighs  approximately  65  pounds.  These  larger  upper 
(or  "forward")  separation  bolts  (one  on  each  Solid  Rocket 
Booster)  and  their  associated  boll  catchers  on  the  External 
Tank  provoked  a  great  deal  of  Board  scrutiny. 

About  two  minutes  after  launch,  the  firing  of  pyrotechnic 
charges  breaks  each  forward  separation  bolt  into  two  pieces, 
allowing  the  spent  Solid  Rocket  Boosters  to  separate  from 
the  External  Tank  (see  Figure  4.2-1 ).  Two  "bolt  catchers"  on 
the  External  Tank  each  trap  the  upper  half  of  a  fired  separa- 
tion bolt,  while  the  lower  half  stays  attached  to  the  Solid 
Rocket  Booster.  As  a  result,  both  halves  are  kept  from  flying 
free  of  the  assembly  and  potentially  hitting  the  Orbiter.  Bolt 
catchers  have  a  domed  aluminum  cover  containing  an  alu- 
minum honeycomb  matrix  that  absorbs  the  fired  bolt's  en- 
ergy. The  two  upper  bolt  halves  and  their  respective  catchers 
subsequently  remain  connected  to  the  External  Tank,  which 
burns  up  on  re-entry,  while  the  lower  hal\es  stay  with  the 
Solid  Rocket  Boosters  that  are  recovered  from  the  ocean. 

If  one  of  the  bolt  catchers  failed  during  STS-107,  the  result- 
ing debris  could  have  damaged  Coliinihia's  wing  leading 
edge.  Concerns  that  the  bolt  catchers  may  have  failed,  caus- 
ing metal  debris  to  ricochet  toward  the  Orbiter,  arose  be- 
cause the  configuration  of  the  bolt  catchers  used  on  Shuttle 
missions  differs  in  impoilant  ways  from  the  design  used  in 
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Figure  4.2-1.   A  cutaway  drawing  of  f/ie  forward  Solid  Rockef 
Booster  bolt  catcher  and  separation  bolt  assembly. 


initial  qualification  tests.'  First,  the  attachments  that  cunent- 
ly  hold  bolt  catchers  in  place  use  bolts  threaded  into  inserts 
rather  than  through-bolts.  Second,  the  test  design  included 
neither  the  Super  Lightweight  .Ablative  material  applied  to 
the  bolt  catcher  apparatus  for  thermal  protection,  nor  the 
aluminum  honeycomb  configuration  currently  used.  Also, 
during  these  initial  tests,  temperature  and  pressure  readings 
for  the  bolt  firings  were  not  recorded. 

Instead  of  conducting  additional  tests  to  correct  for  these 
discrepancies.  NASA  engineers  qualified  the  flight  design 
configuration  using  a  process  called  "analysis  and  similar- 
ity." The  flight  configuration  was  validated  using  extrapo- 
lated test  data  and  redesign  specifications  rather  than  direct 
testing.  This  means  that  N.ASA"s  rationale  for  considering 
bolt  catchers  to  be  safe  for  flight  is  based  on  limited  data 
from  testing  24  years  ago  on  a  model  that  differs  signifi- 
cantly from  the  current  design. 

Due  to  these  testing  deficiencies,  the  Board  recognized 
that  bolt  catchers  could  have  played  a  role  in  damaging 
Coliinihi(i\  left  wing.  The  aluminum  dome  could  have 
failed  catastrophically.  ablative  coating  could  have  come  off 
in  large  quantities,  or  the  device  could  have  failed  to  hold  to 
its  mount  point  on  the  External  Tank.  To  determine  whether 
bolt  catchers  should  be  eliminated  as  a  source  of  debris,  in- 
vestigators conducted  tests  to  establish  a  performance  base- 
line for  bolt  catchers  in  their  current  configuration  and  also 
reviewed  radar  data  to  see  whether  boh  catcher  failure  could 
be  observed.  The  results  had  serious  implications:  Every 
bolt  catcher  tested  failed  well  below  the  expected  load  range 
of  6X.000  pounds.  In  one  test,  a  bolt  catcher  failed  at  44,()()0 
pounds,  which  was  two  percent  below  the  46.()()()  pounds 


generated  by  a  fired  separation  bolt.  This  means  that  the 
force  at  which  a  separation  bolt  is  predicted  to  come  apart 
during  flight  could  exceed  the  bolt  catcher's  ability  to  safely 
capture  the  bolt.  If  these  results  are  consistent  with  further 
tests,  the  factor  of  safety  for  the  bolt  catcher  system  would 
be  0.956  -  far  below  the  design  requirement  of  1 .4  (that  is, 
able  to  withstand  1 .4  times  the  maximum  load  ever  expected 
in  operation). 

Every  bolt  catcher  must  be  inspected  (via  X-ray)  as  a  final 
step  in  the  manufacturing  process  to  ensure  specification 
compliance.  There  are  specific  requirements  for  film  type/ 
quality  to  allow  sufficient  visibility  of  weld  quality  (where 
the  dome  is  mated  to  the  mounting  flange)  and  reveal  any 
flaws.  There  is  also  a  requirement  to  archive  the  film  for  sev- 
eral years  after  the  hardware  has  been  used.  The  manufac- 
turer is  required  to  evaluate  the  film,  and  a  Defense  Contract 
Management  Agency  representative  certifies  that  require- 
ments have  been  met.  The  substandard  peiformance  of  the 
Summa  bolt  catchers  tested  by  NASA  at  Marshall  Space 
Flight  Center  and  subsequent  investigation  revealed  that 
the  contractor's  use  of  film  failed  to  meet  quality  require- 
ments and,  because  of  this  questionable  quality,  there  were 
"probable"  weld  defects  in  most  of  the  archived  film.  Film 
of  STS-107's  bolt  catchers  (serial  numbers  I  and  19.  both 
Summa-manufactured),  was  also  determined  to  be  substan- 
dard with  "probable"  weld  defects  (cracks,  porosity,  lack 
of  penetration)  on  number  1  (left  Solid  Rocket  Booster  to 
External  Tank  attach  point).  Number  19  appeared  adequate, 
though  the  substandard  film  quality  leaves  some  doubt. 

Further  investigation  revealed  that  a  lack  of  qualified 
non-destructive  inspection  technicians  and  differing  inter- 
pretations of  inspection  requirements  contributed  to  this 
oversight.  United  Space  Alliance,  NASA's  agent  in  pro- 
curing bolt  catchers,  exercises  limited  process  oversight 
and  delegates  actual  contract  compliance  verification  to 
the  Defense  Contract  Management  Agency.  The  Defense 
Contract  Management  Agency  interpreted  its  responsibility 
as  limited  to  certifying  compliance  with  the  requirement  for 
X-ray  inspections.  Since  neither  the  Defense  Contract  Man- 
agement Agency  nor  United  Space  Alliance  had  a  resident 
non-destructive  inspection  specialist,  they  could  not  read  the 
X-ray  film  or  certify  the  weld.  Consequently,  the  required 
inspections  of  weld  quality  and  end-item  certification  were 
not  properly  performed.  Inadequate  oversight  and  confusion 
over  the  requirement  on  the  parts  of  NASA.  United  Space 
Alliance,  and  the  Defense  Contract  Management  Agency  all 
contributed  to  this  problem. 

In  addition,  STS-107  radar  data  from  the  U.S.  Air  Force 
Eastern  Range  tracking  system  identified  an  object  with  a 
radar  cross-section  consistent  with  a  bolt  catcher  departing 
the  Shuttle  stack  at  the  time  of  Solid  Rocket  Booster  separa- 
tion. The  resolution  of  the  radar  return  was  not  sufficient  to 
definitively  identify  the  object.  However,  an  object  that  has 
about  the  same  radar  signature  as  a  bolt  catcher  was  seen  on 
at  least  five  other  Shuttle  missions.  Debris  shedding  during 
Solid  Rocket  Booster  separation  is  not  an  unusual  event. 
However,  the  size  of  this  object  indicated  that  it  could  be  a 
potential  threat  if  it  came  close  to  the  Orbiter  after  coming 
off  the  stack. 
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Although  bolt  catchers  can  be  neither  definitively  excluded 
nor  included  as  a  potential  cause  of  left  wing  damage  to 
Coliiinhia.  the  impact  of  such  a  large  object  would  likely 
have  registered  on  the  Shuttle  stack's  sensors.  The  indefinite 
data  at  the  time  of  Solid  Rocket  Booster  separation,  in  tan- 
dem with  overwhelming  evidence  related  to  the  foam  debris 
strike,  leads  the  Board  to  conclude  that  bolt  catchers  are 
unlikely  to  have  been  involved  in  the  accident. 


Findings: 


H-4.2-1 


F4.2- 


F4.2-3 


F4.2-4 


The  certification  of  the  bolt  catchers  flown  on 
STS-107  was  accomplished  by  extrapolating 
analysis  done  on  similar  but  not  identical  bolt 
catchers  in  original  testing.  No  testing  of  flight 
hardware  was  performed. 

Board-directed  testing  of  a  small  sample  size 
demonstrated  that  the  "as-flown"  bolt  catchers 
do  not  have  the  required  1.4  margin  of  safety. 
Quality  assurance  processes  for  bolt  catchers  (a 
Critical ity  I  subsystem)  were  not  adequate  to  as- 
sure contract  compliance  or  product  adequacy. 
An  unknown  metal  object  was  seen  separating 
from  the  stack  during  Solid  Rocket  Booster  sepa- 
ration during  six  Space  Shuttle  missions.  These 
objects  were  not  identified,  but  were  character- 
ized as  of  little  to  no  concern. 


Recommendations: 


R4.2- 


Test  and  qualify  the  flight  hardware  bolt  catch- 
ers. 


Kapton  Wiring 

Because  of  previous  problems  with  its  use  in  the  Space  Shut- 
tle and  its  implication  in  aviation  accidents,  Kapton-insulated 
wiring  was  targeted  as  a  possible  cause  of  the  Coliiinhia 
accident.  Kapton  is  an  aromatic  polyimide  insulation  that 
the  DuPont  Corporation  developed  in  the  1960s.  Because 
Kapton  is  lightweight,  nonflammable,  has  a  wide  operating 
temperature  range,  and  resists  damage,  it  has  been  widely 
used  in  aircraft  and  spacecraft  for  more  than  30  years.  Each 
Orbiter  contains  140  to  157  miles  of  Kapton-insulated  wire, 
approximately  1,700  feet  of  which  is  inaccessible. 

Despite  its  positive  properties,  decades  of  use  have  revealed 
one  significant  problem  that  was  not  apparent  during  its 
development  and  initial  use:  Kapton  insulation  can  break 
down,  leading  to  a  phenomenon  known  as  arc  tracking. 
When  arc  tracking  occurs,  the  insulation  turns  to  carbon,  or 
carbonizes,  at  teinperatures  of  1 ,  100  to  1 ,200  degrees  Fahr- 
enheit. Carbonization  is  not  the  same  as  combustion.  Dur- 
ing tests  unrelated  to  Columbia.  Kapton  wiring  placed  in  an 
open  flame  did  not  continue  to  bum  when  the  wiring  was 
removed  from  the  flame.  Nevertheless,  when  carbonized, 
Kapton  becomes  a  conductor,  leading  to  a  "soft  electrical 
short"  that  causes  systems  to  gradually  fail  or  operate  in 
a  degraded  fashion.  Improper  installati()n  and  inishandling 
during  inspection  and  maintenance  can  also  cause  Kapton 
insulation  to  split,  crack,  tiake,  or  otherwise  physically  de- 
grade.- (Arc  tracking  is  pictured  in  Figure  4.2-2.) 


Figure  4.2-2.  Arc  tracking  damage  ir^  Kapton  wiring. 


Perhaps  the  greatest  concern  is  the  breakdown  of  the  wire's 
insulation  when  exposed  to  moisture.  Over  the  years,  the 
Federal  Aviation  .Administration  has  undertaken  extensive 
studies  into  wiring-related  issues,  and  has  issued  Advi- 
sory Circulars  (2.5-16  and  43. 13- IB)  on  aircraft  wiring 
that  discuss  using  aromatic  polyimide  insulation.  It  was 
discovered  that  as  long  as  the  wiring  is  designed,  installed, 
and  maintained  properly,  it  is  safe  and  reliable,  it  was  also 
discovered,  however,  that  the  aromatic  polyimide  insulation 
does  not  function  well  in  high-moisture  environments,  or 
in  installations  that  require  large  or  frequent  flexing.  The 
military  had  discovered  the  potentially  undesirable  aspects 
of  aromatic  polyimide  insulation  much  eariier.  and  had  ef- 
fectively banned  its  use  on  new  aircraft  beginning  in  19K3. 
These  rules,  however,  apply  only  to  pure  polyimide  insula- 
tion; various  other  insulations  that  contain  polyimide  are 
still  used  in  appropriate  areas. 

The  first  extensive  scnitiny  of  Kapton  wiring  on  any  of  the 
Orbiters  occurred  during  Columbia's  third  Orbiter  Major 
Modification  period,  after  a  serious  system  malfunction  dur- 
ing the  STS-93  launch  of  Coliiiiibia  in  July  1999.  A  short  cir- 
cuit five  seconds  after  liftoff  caused  two  of  the  six  Main  En- 
gine Controller  computers  to  lose  power,  which  could  have 
caused  one  or  two  of  the  three  Main  Engines  to  shut  down. 
The  ensuing  investigation  identified  damaged  Kapton  wire 
as  the  cau.se  of  the  malfunction.  In  order  to  identify  and  cor- 
rect such  wiring  problems,  all  Orbiters  were  grounded  for  an 
initial  (partial)  inspection,  with  more  extensive  inspections 
planned  during  their  next  depot-level  maintenance.  During 
Columbia's  subsequent  Orbiter  Major  Modification,  wiring 
was  inspected  and  redundant  system  wiring  in  the  same  bun- 
dles was  separated  to  prevent  arc  tracking  damage.  Nearly 
4,900  wiring  nonconformances  (conditions  that  did  not 
meet  specifications)  were  identified  and  corrected.  Kapton- 
related  problems  accounted  for  approximately  27  percent  of 
the  nonconformances.  This  examination  revealed  a  strong 
ccurelation  between  wire  damage  and  the  Orbiter  areas  that 
had  experienced  the  most  foot  traffic  during  maintenance 
and  modification.' 
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Other  aspects  of  Shuttle  operation  may  degrade  Kapton 
wiring.  In  orbit,  atomic  oxygen  acts  as  an  oxidizing  agent, 
causing  chemical  reactions  and  physical  erosion  that  can 
lead  to  mass  loss  and  surface  property  changes.  Fortunately, 
actual  exposure  has  been  relatively  limited,  and  inspections 
show  that  degradation  is  minimal.  Laboratory  tests  on  Kap- 
ton also  confirm  that  on-orbit  ultraviolet  radiation  can  cause 
delamination,  shrinkase,  and  wrinklins. 


Finding: 


F4.2-5 


Figure  4.2-3.  Typical  wiring  bundle  imide  Orbifer  wing. 


A  typical  wiring  bundle  is  shown  in  Figure  4.2-3.  Wiring 
nonconformances  are  connected  by  rerouting,  reclamping. 
or  installing  additional  insulation  such  as  convoluted  tub- 
ing, insulating  tape,  insulating  sheets,  heat  shrink  sleeving, 
and  abrasion  pads  (see  Figure  4.2-4).  Testing  has  shown 
that  wiring  bundles  usually  stop  arc  tracking  when  wires  are 
physically  separated  from  one  another.  Funher  testing  un- 
der conditions  simulating  the  Shuttle's  wiring  environment 
demonstrated  that  arc  tracking  does  not  progress  beyond  six 
inches.  Based  on  these  results.  Boeing  recommended  that 
NASA  separate  all  critical  paths  from  larger  wire  bundles  and 
individually  protect  them  for  a  minimum  of  six  inches  be- 
yond their  separation  points.^  This  recommendation  is  being 
adopted  through  modifications  performed  during  scheduled 
Orbiter  Major  Modihcations.  For  example,  analysis  of  tele- 
metered data  from  14  of  Columbia 'i  left  wing  sensors  (hy- 
draulic line/wing  skin/wheel  temperatures,  tire  pressures,  and 
landing  gear  downlock  position  indication)  provided  failure 
signatures  supporting  the  scenario  of  left-wing  thermal  intru- 
sion, as  oppo.sed  to  a  catastrophic  failure  (extensive  arc  track- 
ing) of  Kapton  wiring.  Actual  NASA  testing  in  the  months 
following  the  accident,  during  which  wiring  bundles  were 
subjected  to  intense  heat  (ovens,  blowtorch,  and  arc  jet),  veri- 
fied the  failure  signature  analyses.  Finally,  extensive  testing 
and  analysis  in  years  prior  to  STS-107  showed  that,  with  the 
low  currents  and  low  voltages  associated  with  the  Orbiter's 
instrumentation  system  (such  as  those  in  the  left  wing),  the 
probability  of  arc  tracking  is  commensurately  low. 


Based  on  the  extensive  wiring  inspections,  main- 
tenance, and  modifications  prior  to  STS-107, 
analysis  of  sensor/wiring  failure  signatures,  and 
the  alignment  of  the  signatures  with  themial 
intrusion  into  the  wing,  the  Board  found  no 
evidence  that  Kapton  wiring  problems  caused  or 
contributed  to  this  accident. 


Recommendation: 

R4.2-2  As  pail  of  the  Shuttle  Service  Life  Extension  Pro- 
gram and  potential  40-year  service  life,  develop  a 
state-of-the-art  means  to  inspect  all  Orbiter  wir- 
ing, including  that  which  is  inaccessible. 

Crushed  Foam 

Based  on  the  anticipated  launch  date  of  STS-107,  a  set 
of  Solid  Rocket  Boosters  had  been  stacked  in  the  Vehicle 
Assembly  Building  and  a  Lightweight  Tank  had  been  at- 
tached to  them.  A  reshuffling  of  the  manifest  in  .luly  2002 
resulted  in  a  delay  to  the  STS-107  mission.^  It  was  decided 
to  use  the  already-stacked  Solid  Rocket  Boosters  for  the 
STS-II3  mission  to  the  international  Space  Station.  All 
flights  to  the  International  Space  Station  use  Super  Light- 
weight Tanks,  meaning  that  the  External  Tank  already  mated 
would  need  to  be  removed  and  stored  pending  the  rescheduled 
STS-107  mission.  Since  External  Tanks  are  not  stored  with 
the  bipod  struts  attached,  workers  at  the  Kennedy  Space 
Center  removed  the  bipod  strut  from  the  Lightweight  Tank 
before  it  was  lifted  into  a  storage  cell." 

Following  the  de-mating  of  the  bipod  strut,  an  area  of 
crushed  PDL-1034  foam  was  found  in  the  region  beneath 
where  the  left  bipod  strut  attached  to  the  tank's  -Y  bipod 
fitting.  The  region  measured  about  1.5  inches  by  1.25  inches 
by  0.187  inches  and  was  located  at  roughly  the  five  o'clock 
position.  Foam  thickness  in  this  region  was  2.187  inches. 


Examples  of  Harness  Protection 


Silicon  Rubber  Extrusion     "" 


Figure  4.2-4.  Typical  wiring  harness  profecfion  methods. 
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The  crushed  foam  was  exposed  when  the  bipod  strut  was 
removed.  This  constituted  an  unacceptable  condition  and 
required  a  Problem  Report  write-up.^ 

NASA  conducted  testing  at  the  Michoud  Assembly  Facility 
and  at  Kennedy  Space  Center  to  determine  if  crushed  foam 
could  have  caused  the  loss  of  the  left  bipod  ramp,  and  to  de- 
termine if  the  limits  specified  in  Problem  Report  procedures 
were  sufficient  for  safety." 

Kennedy  engineers  decided  not  to  take  action  on  the  crushed 
foam  because  it  would  be  covered  after  the  External  Tank 
was  mated  to  a  new  set  of  bipod  struts  that  would  connect 
it  to  Columbia,  and  the  struts  would  sufficiently  contain  and 
shield  the  crushed  foam."  An  inspection  after  the  bipod  struts 
were  attached  determined  that  the  area  of  crtished  foam  was 
within  limits  specified  in  the  drawing  for  this  region.'" 

STS-107  was  therefore  launched  with  crushed  foam  behind 
the  clevis  of  the  left  bipod  strut.  Crushed  foam  in  this  region 
is  a  routine  occurrence  because  the  foam  is  poured  and  shaved 
so  that  the  mating  of  the  bipod  strut  to  the  bipod  fitting  results 
in  a  tight  fit  between  the  bipod  strtit  and  the  foam. 

Pre-launch  testing  showed  that  the  extent  of  crushed  foam 
did  not  exceed  limits."  In  these  tests,  red  dye  was  wicked 
into  the  crushed  (open)  foam  cells,  and  the  damaged  and 
dyed  foam  was  then  cut  out  and  examined.  Despite  the  ef- 
fects of  crushing,  the  foam's  thickness  around  the  bipod  at- 
tach point  was  not  sub.stantially  reduced;  the  foam  effective- 
ly maintained  insulation  against  ice  and  frost.  The  crushed 
foam  was  contained  by  the  bipod  struts  and  was  subjected  to 
little  or  no  airflow. 


Finding: 


F4.2-6 


Crushed  foam  does  not  appear  to  have  contrib- 
uted to  the  loss  of  the  bipod  foam  ramp  off  the 
External  Tank  during  the  ascent  of  STS- 107. 


Recommendations: 

•  None 

Hypergolic  Fuel  Spill 

Concerns  that  hypergolic  (ignites  spontaneously  when 
mixed)  fuel  contamination  might  have  contributed  to  the 
accident  led  the  Board  to  investigate  an  August  20,  1999, 
hydrazine  spill  at  Kennedy  Space  Center  that  occurred  while 
Columbia  was  being  prepared  for  shipment  to  the  Boeing 
facility  in  Palmdale,  California.  The  spill  occurred  when  a 
maintenance  technician  disconnected  a  hydrazine  fuel  line 
without  capping  it.  When  the  fuel  line  was  placed  on  a  main- 
tenance platform.  2.25  ounces  of  the  volatile,  corrosive  fuel 
dripped  onto  the  trailing  edge  of  the  Orbiter's  left  inboard 
elevon.  After  the  spill  was  cleaned  up,  two  tiles  were  re- 
moved for  inspection.  No  damage  to  the  control  surface  skin 
or  structure  was  found,  and  the  tiles  were  replaced.'^ 

United  Space  Alliance  briefed  all  employees  working  with 
these  systems  on  procedures  to  prevent  another  spill,  and  on 


November  1,  1999,  the  Shuttle  Operations  Advisory  Group 
was  briefed  on  the  corrective  action  that  had  been  taken. 

Finding: 

F4.2-7        The  hypergolic  spill  was  not  a  factor  in  this  ac- 
cident. 

Recommendations: 

•  None 

Space  Weather 

Space  weather  refers  to  the  action  of  highly  energetic  par- 
ticles in  the  outer  layers  of  Earth's  atmosphere.  Eruptions  of 
particles  from  the  sun  are  the  primary  source  of  space  weath- 
er events,  which  fluctuate  daily  or  even  more  frequently.  The 
most  common  space  weather  concern  is  a  potentially  harmful 
radiation  dose  to  astronauts  during  a  mission.  Particles  can 
also  cau.se  structural  damage  to  a  vehicle,  harm  electronic 
components,  and  adversely  affect  communication  links. 

After  the  accident,  several  researchers  contacted  the  Board 
and  NASA  with  concerns  about  unusual  space  weather 
just  before  Columbia  started  its  re-entry.  A  coronal  mass 
ejection,  or  solar  flare,  of  high-energy  particles  from  the 
outer  layers  of  the  sun's  atmosphere  occurred  on  January  3 1 , 
2003.  The  shock  wave  from  the  solar  flare  passed  Earth  at 
about  the  same  time  that  the  Orbiter  began  its  de-orbit  burn. 
To  examine  the  possible  effects  of  this  solar  flare,  the  Board 
enlisted  the  expertise  of  the  Space  Environmental  Center  of 
the  National  Oceanic  and  Atmospheric  Administration  and 
the  Space  Vehicles  Directorate  of  the  Air  Force  Research 
Laboratory  at  Hanscom  Air  Force  Base  in  Massachusetts. 

Measurements  from  multiple  space-  and  ground-based  sys- 
tems indicate  that  the  solar  flare  occuired  near  the  edge  of 
the  sun  (as  observed  from  Earth),  reducing  the  impact  of  the 
subsequent  shock  wave  to  a  glancing  blow.  Most  of  the  ef- 
fects of  the  solar  flare  were  not  observed  on  Earth  until  six 
or  more  hours  after  Columbia  broke  up.  See  Appendix  D.5 
for  more  on  space  weather  effects. 

Finding: 

F4.2-8        Space  weather  was  not  a  factor  in  this  accident. 

Recommendations: 

•  None 

Asymmetric  Boundary  Layer  Transition 

Columbia  had  recently  been  through  a  complete  refurbish- 
ment, including  detailed  inspection  and  certification  of  all 
lower  wing  surface  dimensions.  Any  grossly  protruding 
gap  fillers  would  have  been  observed  and  repaired.  Indeed, 
though  investigators  found  that  Columbia's  reputation  for  a 
rough  left  wing  was  well  deserved  prior  to  STS-75,  quantita- 
tive measurements  show  that  the  measured  wing  roughness 
was  below  the  fleet  average  by  the  launch  of  STS-107." 
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Finding: 

F4.2-9        A  "rough  wing"  was  not  a  factor  in  this  accident. 

Recommendations: 

•  None 

Training  and  On-Orbit  Performance 

All  mission-specific  training  requirements  for  STS-107 
launch  and  flight  control  operators  were  completed  before 
launch  with  no  perfonnance  problems.  However,  seven 
flight  controllers  assigned  to  the  mission  did  not  have 
current  recertitications  at  the  time  of  the  Flight  Readiness 
Review,  nor  were  they  certified  by  the  mission  date.  (Most 
flight  controllers  must  recertify  for  their  positions  every  18 
months.)  The  Board  has  determined  that  this  oversight  had 
no  bearing  on  mission  performance  (see  Chapter  6).  The 
Launch  Control  Team  and  crew  members  held  a  full  "dress 
rehearsal"  of  the  launch  day  during  the  Terminal  Countdown 
Demonstration  Test.  See  Appendix  D.  I  for  additional  details 
on  training  for  STS-107. 

Because  the  majority  of  the  mission  was  completed  before 
re-entry,  an  assessment  of  the  training  preparation  and 
flight  readiness  of  the  crew,  launch  controllers,  and  Hight 
controllers  was  based  on  the  documented  peiformance 
of  mission  duties.  All  STS-107  personnel  performed 
satisfactorily  during  the  launch  countdown,  launch, 
and  mission.  Crew  and  mission  controller  actions  were 
consistent  with  re-entry  procedures. 

There  were  a  few  incorrect  switch  movements  by  the 
crew  during  the  mission,  including  the  configuration  of  an 
inter-communications  switch  and  an  accidental  bump  of 
a  rotational  hand  controller  (which  affected  the  Orbiter's 
attitude)  after  the  de-orbit  burn  but  prior  to  Entry  Interface. 
The  inter-communications  switch  error  was  identified  and 
then  corrected  by  the  crew;  both  the  crew  and  Mission 
Control  noticed  the  bump  and  took  the  necessai^  steps  to 
place  the  Orbiter  in  the  correct  attitude.  Neither  of  these 
events  was  a  factor  in  the  accident,  nor  are  they  considered 
training  or  performance  issues.  Details  on  STS-107  on-orbit 
operations  are  in  Appendix  D.2. 


Find 


mg: 


F4.2-10 


The  Board  concludes  that  training  and  on-orbit 
considerations  were  not  factors  in  this  accident. 


Recommendations: 

•  None 

Payloods 

To  ensure  that  a  payload  malfunction  did  not  cause  or  con- 
tribute to  the  Coliimhiu  accident,  the  Board  conducted  a 
thorough  examination  of  all  pay  loads  and  their  integration 
with  the  Orbiter's  systems.  The  Board  reviewed  all  down- 
linked payload  telemetry  data  during  the  mission,  as  well  as 


all  payload  hardware  technical  documentation.  Investigators 
assessed  every  payload  readiness  review,  safety  review,  and 
payload  integration  process  used  by  NASA,  and  interviewed 
individuals  involved  in  the  payload  process  at  both  Johnson 
and  Kennedy  Space  Centers. 

The  Board's  review  of  the  STS-107  Flight  Readiness  Review, 
Payload  Readiness  Review.  Payload  Safety  Review  Panel, 
and  Integrated  Safety  Assessments  of  experiment  payloads 
on  STS-107  found  that  all  pay  load-associated  hazards  were 
adequately  identified,  accounted  for,  and  appropriately  miti- 
gated. Payload  integration  engineers  encountered  no  unique 
problems  during  SPACEH  AB  integration,  there  were  no  pay- 
load  constraints  on  the  launch,  and  there  were  no  guideline 
violations  during  the  payload  preparation  process. 

The  Board  evaluated  1 1  payload  anomalies,  one  of  which 
was  significant.  A  SPACEHAB  Water  Separator  Assembly 
leak  under  the  aft  sub-floor  caused  an  electrical  short  and 
subsequent  shutdown  of  both  Water  Separator  Assemblies. 
Ground  and  flight  crew  responses  sufficiently  addressed  these 
anomalies  during  the  mission.  Circuit  protection  and  telem- 
etry data  further  indicate  that  during  re-entry,  this  leak  could 
not  have  produced  a  similar  electrical  short  in  SPACEHAB 
that  might  have  affected  the  main  Orbiter  power  supply. 

The  Board  detemiined  that  the  powered  payloads  aboard 
STS-107  were  performing  as  expected  when  the  Orbiter's 
signal  was  lost.  In  addition,  all  potential  "fault-tree"  payload 
failures  that  could  have  contributed  to  the  Orbiter  breakup 
were  evaluated  using  real-time  downlinked  telemetry,  debris 
analysis,  or  design  specification  analysis.  These  analyses  in- 
dicate that  no  such  failures  occurred. 

Several  experiments  within  SPACEHAB  were  flammable, 
used  flames,  or  involved  combustible  materials.  All  down- 
linked SPACEHAB  telemetry  was  normal  through  re-entry, 
indicating  no  unexpected  rise  in  temperature  within  the 
module  and  no  increases  in  atmospheric  or  hull  pressures. 
All  fire  alarms  and  indicators  within  SPACEHAB  were  op- 
erational, and  they  detected  no  smoke  or  fire.  Gas  percent- 
ages within  SPACEHAB  were  also  within  limits. 

Because  a  major  shift  in  the  Orbiter's  center  of  gravity 
could  potentially  cause  flight-control  or  heat  management 
problems,  researchers  investigated  a  possible  shifting  of 
equipment  in  the  payload  bay.  Telemetrj'  during  re-entry 
indicated  that  all  payload  cooling  loops,  electrical  wiring, 
and  communications  links  were  functioning  as  expected, 
supporting  the  conclusion  that  no  payload  came  loose  dur- 
ing re-entry.  In  addition,  there  are  no  indications  from  the 
Orbiter's  telemetry  that  any  flight  control  adjustments  were 
made  to  compensate  for  a  change  in  the  Orbiter's  center  of 
gravity,  which  indicates  that  the  center  of  gravity  in  the  pay- 
load  bay  did  not  shift  during  re-entry. 

The  Board  explored  whether  the  pressurized  SPACEHAB 
module  may  have  ruptured  during  re-entry.  A  rup  Hire  could 
breach  the  fuselage  of  the  Orbiter  or  force  open  the  pay- 
load  bay  doors,  allowing  hot  gases  to  enter  the  Orbiter.  All 
downlinked  payload  telemetry  indicates  that  there  was  no 
decompression  of  SPACEHAB  prior  to  loss  of  signal,  and 
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(Abovej  The  SPACEHAB  Research  Double  Module  (left)  and  Hitchhiker  Carrier  are  lowered  foward  Columbia's  payload  bay  on  May  23, 
2002.  The  Fast  Reaction  Experiments  Enabling  Science,  Tecfino/ogy,  Applications  and  Research  (FREESTAR)  is  on  the  Hitchhiker  Carrier. 

(Below)  Columbia's  payload  bay  doors  are  ready  to  be  closed  over  the  SPACEHAB  Research  Double  Module  on  June  14,  2002. 
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no  dramatic  increase  in  internal  temperature  or  change  in  the 
air  composition.  This  analysis  suggests  that  the  pressurized 
SPACEHAB  module  did  not  rupture  during  re-entry  (see 
Appendix  D.6.). 


Finding: 


F4.2-II 


The  payloads  Columbia  carried  were  not  a  factor 
in  this  accident. 


Recommendations: 

•  None 

Willful  Damage  and  Security 

During  the  Board's  investigation,  suggestions  of  willful 
damage,  including  the  possibility  of  a  terrorist  act  or  sabo- 
tage by  a  disgruntled  employee,  surfaced  in  the  media  and 
on  various  Web  sites.  The  Board  assessed  such  theories, 
giving  particular  attention  to  the  unprecedented  security 
precautions  taken  during  the  launch  of  STS-i07  because  of 
prevailing  national  security  concerns  and  the  inclusion  of  an 
Israeli  crew  member. 

Speculation  that  Columbia  was  shot  down  by  a  missile  was 
easily  dismissed.  The  Orbiter's  altitude  and  speed  prior 
to  breakup  was  far  beyond  the  reach  of  any  air-to-air  or 
surface-to-air  missile,  and  telemetry  and  Orbiter  support 
system  data  demonstrate  that  events  leading  to  the  breakup 
began  at  even  greater  altitudes. 

The  Board's  evaluation  of  whether  sabotage  played  any 
role  included  several  factors:  security  planning  and  counter- 
measures,  personnel  and  facility  security,  maintenance  and 
processing  procedures,  and  debris  analysis. 

To  rule  out  an  act  of  sabotage  by  an  employee  with  access 
to  these  facilities,  maintenance  and  processing  procedures 
were  thoroughly  reviewed.  The  Board  also  interviewed  em- 
ployees who  had  access  to  the  Orbiter. 

The  processes  in  place  to  detect  anything  unusual  on  the  Or- 
biter. from  a  planted  explosive  to  a  bolt  incorrectly  torqued. 
make  it  likely  that  anything  unusual  would  be  caught  during 
the  many  checks  that  employees  perform  as  the  Orbiter  nears 
final  closeout  (closing  and  sealing  panels  that  have  been  left 
open  for  inspection)  prior  to  launch,  in  addition,  the  process 
of  securing  various  panels  before  launch  and  taking  close- 
out  photos  of  hardware  (see  Figure  4.2-5)  almost  always 
requires  the  presence  of  more  than  one  person,  which  means 
a  saboteur  would  need  the  complicity  of  at  least  one  other 
employee,  if  not  more. 

Debris  from  Columbia  was  examined  for  traces  of  explo- 
sives that  would  indicate  a  bomb  onboard.  Federal  Bureau 
of  Investigation  laboratories  provided  analysis.  Laboratory 
technicians  took  multiple  samples  of  debris  specimens  and 
compared  them  with  swabs  from  Atlantis  and  Discovery. 
Visual  examination  and  gas  chromatography  with  chemi- 
luminescence  detection  found  no  explosive  residues  on  any 
specimens  that  could  not  be  traced  to  the  Shuttle's  pyrotech- 


Figure  4.2-5.  Ai  left,  a  wing  secfion  open  for  inspection;  at  right, 
wing  access  closed  off  after  inspection. 


nic  devices.  Additionally,  telemetry  and  other  data  indicate 
these  pyrotechnic  devices  operated  normally. 

In  its  review  of  willful  damage  scenarios  mentioned  in  the 
press  or  submitted  to  the  investigation,  the  Board  could  not 
find  any  that  were  plausible.  Most  demonstrated  a  basic  lack 
of  knowledge  of  Shuttle  processing  and  the  physics  of  explo- 
sives, altitude,  and  thermodynamics,  as  well  as  the  processes 
of  maintenance  documentation  and  employee  screening. 

NAS.A  and  its  contractors  have  a  comprehensive  security 
system,  outlined  in  documents  like  NASA  Policy  Directive 
I600.2A.  Rules,  procedures,  and  guidelines  address  topics 
ranging  from  foreign  travel  to  information  security,  from  se- 
curity education  to  investigations,  and  from  the  use  offeree 
to  security  for  public  tours. 

The  Board  examined  .security  at  NASA  and  its  related  fa- 
cilities through  a  combination  of  employee  interviews,  site 
visits,  briefing  reviews,  and  discussions  with  security  per- 
sonnel. The  Board  focused  primarily  on  reviewing  the  capa- 
bility of  unauthorized  access  to  Shuttle  system  components. 
Facilities  and  programs  examined  for  security  and  sabotage 
potential  included  ATK  Thiokol  in  Utah  and  its  Reusable 
Solid  Rocket  Motor  production,  the  Michoud  Assembly  Fa- 
cility in  Louisiana  and  its  External  Tank  production,  and  the 
Kennedy  Space  Center  in  Florida  for  its  Orbiter  and  overall 
integration  responsibilities. 

The  Board  visited  the  Boeing  facility  in  Palmdale,  Califor- 
nia; Edwards  Air  Force  Base  in  California;  Stennis  Space 
Center  in  Bay  St.  Louis.  Mississippi;  Marshall  Space  Flight 
Center  near  Huntsville,  Alabama;  and  Cape  Canaveral  Air 
Force  Station  in  Florida.  These  facilities  exhibited  a  variety 
of  security  processes,  according  to  each  site's  unique  de- 
mands. At  Kennedy,  access  to  secure  areas  requires  a  series 
of  identification  card  exchanges  that  electronically  record 
each  entry.  The  Michoud  Assembly  Facility  employs  similar 
measures,  with  additional  security  limiting  access  to  a  com- 
pleted External  Tank.  The  use  of  closed-circuit  television 
systems  complemented  by  security  patrols  is  universal. 

Employee  screening  and  tracking  measures  appear  solid 
across  NASA  and  at  the  contractors  examined  by  the  Board. 
The  agency  relies  on  standard  background  and  law  enforce- 
ment checks  to  prevent  the  hiring  of  applicants  with  ques- 
tionable records  and  the  dismissal  of  those  who  may  accrue 
such  a  record. 
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It  is  difficult  for  anyone  to  access  critical  Shuttle  hardware 
alone  or  unobserved  by  a  responsible  NASA  or  contractor 
employee.  With  the  exception  of  two  processes  when  foam 
is  applied  to  the  External  Tank  at  the  Michoud  Assembly 
Facility,  there  are  no  known  final  closeouts  of  any  Shuttle 
component  that  can  be  completed  with  fewer  than  two  peo- 
ple. Most  closeouts  involve  at  least  five  to  eight  employees 
before  the  component  is  sealed  and  certified  for  flight.  All 
payloads  also  undergo  an  extensive  review  to  ensure  proper 
processing  and  to  verify  that  they  pose  no  danger  to  the  crew 
or  the  Orbiter. 

Security  reviews  also  occur  at  locations  such  as  the  Trans- 
oceanic Abort  Landing  facilities.  These  sites  are  assessed 
prior  to  launch,  and  appropriate  measures  are  taken  to 
guarantee  they  are  secure  in  case  an  emergency  landing  is 
required.  NASA  also  has  contingency  plans  in  place,  includ- 
ing dealing  with  bioterrorism. 

Both  daily  and  launch-day  security  at  the  Kennedy  Space 
Center  has  been  tightened  in  recent  years.  Each  Shuttle 
launch  has  an  extensive  security  countdown,  with  a  variety 
of  checks  to  guarantee  that  signs  are  posted,  beaches  are 
closed,  and  patrols  are  deployed.  K-9  patrols  and  helicopters 
guard  the  launch  area  against  intrusion. 

Because  the  STS-107  manifest  included  Israel's  first  astro- 
naut, security  measures,  developed  with  National  Security 
Council  approval,  went  beyond  the  normally  stringent  pre- 
cautions, including  the  development  of  a  Security  Support 
Plan. 


a  review  of  on-board  accelerometer  data  rules  out  a  major 
strike,  micrometeoroids  or  space  debris  cannot  be  entirely 
ruled  out  as  a  potential  or  contributing  factor. 

Micrometeoroids,  each  usually  no  larger  than  a  grain  of 
sand,  are  numerous  and  particularly  dangerous  to  orbiting 
spacecraft.  Traveling  at  velocities  that  can  exceed  20,000 
miles  per  hour,  they  can  easily  penetrate  the  Orbiter's 
skin.  In  contrast  to  micrometeoroids,  orbital  debris  gener- 
ally comes  from  destroyed  satellites,  payload  remnants, 
exhaust  from  solid  rockets,  and  other  man-made  objects, 
and  typically  travel  at  far  lower  velocities.  Pieces  of  debris 
four  inches  or  larger  are  catalogued  and  tracked  by  the  U.S. 
Air  Force  Space  Command  so  they  can  be  avoided  during 
flight. 

NASA  has  developed  computer  models  to  predict  the  risk 
of  impacts.  The  Orbital  Debris  Model  2000  (ORDEM2000) 
database  is  used  to  predict  the  probability  of  a  micromete- 
oroid  or  space  debris  collision  with  an  Orbiter,  based  on  its 
flight  trajectory,  altitude,  date,  and  duration.  Development 
of  the  database  was  based  on  radar  tracking  of  debris  and 
satellite  experiments,  as  well  as  inspections  of  returned 
Orbiters.  The  computer  code  BUMPER  translates  expected 
debris  hits  from  ORDEM2000  into  an  overall  risk  probabil- 
ity for  each  flight.  The  worst-case  scenario  during  orbital 
debris  strikes  is  known  as  the  Critical  Penetration  Risk, 
which  can  include  the  depressurization  of  the  crew  module, 
venting  or  explosion  of  pressurized  systems,  breaching 
of  the  Thermal  Protection  System,  and  damage  to  control 
surfaces. 


Military  aircraft  patrolled  a  40-mile  Federal  Aviation  Ad- 
ministration-restricted area  starting  nine  hours  before  the 
launch  of  STS-107.  Eight  Coast  Guard  vessels  patrolled  a 
three-nautical-mile  security  zone  around  Kennedy  Space 
Center  and  Cape  Canaveral  Air  Force  Station,  and  Coast 
Guard  and  NASA  boats  patrolled  the  inland  waterways.  Se- 
curity forces  were  doubled  on  the  day  of  the  launch. 

Findings: 

F4.2- 1 2  The  Board  found  no  evidence  that  willful  damage 
was  a  factor  in  this  accident. 

F4.2-13  Two  close-out  processes  at  the  Michoud  Assem- 
bly Facility  are  currently  able  to  be  performed  by 
a  single  person. 

F4.2-14  Photographs  of  every  close  out  activity  are  not 
routinely  taken. 

Recommendation: 

R4.2-3  Require  that  at  least  two  employees  attend  all 
final  closeouts  and  intertank  area  hand-spraying 
procedures. 

Micrometeoroids  and  Orbital  Debris  Risks 

Micrometeoroids  and  space  debris  (often  called  "space 
junk")  are  among  the  most  serious  risk  factors  in  Shuttle 
missions.  While  there  is  little  evidence  that  micrometeor- 
oids or  space  debris  caused  the  loss  of  Coliiiuhia,  and  in  fact 


NASA  guidelines  require  the  Critical  Penetration  Risk  to 
be  better  than  1  in  200,  a  number  that  has  been  the  subject 
of  several  reviews.  NASA  has  made  changes  to  reduce  the 
probability.  For  STS-107.  the  estimated  risk  was  1  in  370. 
though  the  actual  as-flown  value  turned  out  to  be  1  in  356. 
The  current  risk  guideline  of  1  in  200  makes  space  debris  or 
micrometeoroid  strikes  by  far  the  greatest  risk  factor  in  the 
Probabilistic  Risk  Assessment  used  for  missions.  Although 
1  -in-200  flights  may  seem  to  be  long  odds,  and  many  flights 
have  exceeded  the  guideline,  the  cumulative  risk  for  such 
a  strike  over  the  113-flight  history  of  the  Space  Shuttle 
Program  is  calculated  to  be  1  in  3.  The  Board  considers 
this  probability  of  a  critical  penetration  to  be  unacceptably 
high.  The  Space  Station's  micrometeoroid  and  space  debris 
protection  system  reduces  its  critical  penetration  risk  to 
five  percent  or  less  over  10  years,  which  translates  into  a 
per-mission  risk  of  1  in  1 ,200  with  6  flights  per  year,  or  60 
flights  over  10  years. 

To  improve  crew  and  vehicle  safety  over  the  next  10  to  20 
years,  the  Board  believes  risk  guidelines  need  to  be  changed 
to  compel  the  Shuttle  Program  to  identify  and,  more  to  the 
point,  reduce  the  micrometeoroid  and  orbital  debris  threat 
to  missions. 


Findings: 

F4.2-15 


There  is  little  evidence  that  Colimihki  encoun- 
tered either  micrometeoroids  or  orbital  debris  on 
this  flight. 


9  4 


Report    V o u u m e     I  A u b u s t     ZOQ3 


COLUMBIA 

ACCIDENT  INVESTIGATION  BOARO 


F4.2-16  The  Board  found  markedly  different  criteria  for 
margins  of  micrometeoroid  and  orbital  debris 
safety  between  the  hitemational  Space  Station 
and  the  Shuttle. 

Recommendation: 

R4.2-4  Require  the  Space  Shuttle  to  be  operated  with  the 
same  degree  of  safety  for  micrometeoroid  and 
orbital  debris  as  the  degree  of  safety  calculated 
for  the  International  Space  Station.  Change  the 
micrometeoroid  and  orbital  debris  safety  criteria 
from  guidelines  to  requirements. 

Orbiter  Major  Modification 

The  Board  investigated  concerns  that  mistakes,  mishaps,  or 
human  error  during  Columbia  s  last  Orbiter  Major  Modi- 
fication might  have  contributed  to  the  accident.  Orbiters 
are  removed  from  service  for  inspection,  maintenance,  and 
modification  approximately  every  eight  flights  or  three  years. 
Columbia  began  its  last  Orbiter  Major  Modification  in  Sep- 
tember 1999,  completed  it  in  February  2001,  and  had  flown 
once  before  STS-I07.  Several  aspects  of  the  Orbiter  Major 
Modification  process  trouble  the  Board,  and  need  to  be  ad- 
dressed for  future  flights.  These  concerns  are  discussed  in 
Chapter  10. 


Findings: 


F4.2-17 


Based  on  a  thorough  investigation  of  maintenance 
records  and  interviews  with  maintenance  person- 
nel, the  Board  found  no  errors  during  Columbia's. 
most  recent  Orbiter  Major  Modification  that  con- 
tributed to  the  accident. 


Recommendations: 

•  None 

Foreign  Object  Damage  Prevention 

Problems  with  the  Kennedy  Space  Center  and  United  Space 
Alliance  Foreign  Object  Damage  Prevention  Program, 
which  in  the  Department  of  Defense  and  aviation  industry 
typically  falls  under  the  auspices  of  Quality  Assurance,  are 
related  to  changes  made  in  2001.  In  that  year,  Kennedy  and 
Alliance  redefined  the  single  term  "Foreign  Object  Damage" 
-  an  industry-standard  blanket  term  -  into  two  terms:  "Pro- 
cessing Debris"  and  "Foreign  Object  Debris." 

Processing  Debris  then  became: 

Any  material,  product,  substance,  tool  or  aid  generally 
used  during  the  processing  of  flight  hardware  that  re- 
mains in  the  work  area  when  not  directly  in  use,  or  that 
is  left  unattended  in  the  work  area  ft  )r  any  length  of  time 
during  the  processing  of  tasks,  or  that  is  left  remaining 
or  forgotten  in  the  work  area  after  the  completion  of  a 
task  or  at  the  end  of  a  work  shift.  Also  any  item,  mate- 
rial or  substance  in  the  work  area  that  should  he  found 
and  removed  as  part  of  standard  housekeeping.  Hazard 


Recognition  and  Inspection  Program  (HRIP)  walk- 
downs,  or  as  part  of  "Clean  As  You  Go"  practices."* 

Foreign  Object  Debris  then  became: 

Processing  debris  becomes  FOD  when  it  poses  a  poten- 
tial risk  to  the  Shuttle  or  any  of  its  components,  and  only 
occurs  when  the  debris  is  found  during  or  subsequent  to 
a  final/flight  Closeout  Inspection,  or  subsequent  to  OMI 
S0007  ET  Umd  SAF/FAC  yndkdown.'' 

These  definitions  are  inconsistent  with  those  of  other  NASA 
centers.  Naval  Reactor  programs,  the  Department  of  De- 
fense, commercial  aviation,  and  National  Aerospace  FOD 
Prevention  Inc.  guidelines."'  They  are  unique  to  Kennedy 
Space  Center  and  United  Space  Alliance. 

Because  debris  of  any  kind  has  critical  safety  implications, 
these  definitions  are  important.  The  United  Space  Alliance 
Foreign  Object  Program  includes  daily  debris  checks  by 
management  to  ensure  that  workers  comply  with  United 
Space  Alliance's  "clean  as  you  go"  policy,  but  United  Space 
.Alliance  statistics  reveal  that  the  success  rate  of  daily  debris 
checks  is  between  70  and  86  percent.'" 

The  perception  among  many  interviewees  is  that  these  novel 
definitions  mitigate  the  impact  of  Kennedy  Mission  As- 
surance-found Foreign  Object  Debris  on  the  United  Space 
Alliance  award  fee.  This  is  because  "Processing  Debris" 
statistics  do  not  directly  affect  the  award  fee.  Simply  put, 
in  splitting  "Foreign  Object  Damage"  into  two  categories, 
many  of  the  violations  are  tolerated.  Indeed,  with  18  prob- 
lem reports  generated  on  "lost  items"  during  the  processing 
of  STS-107  alone,  the  need  for  an  ongoing,  thorough,  and 
stringent  Foreign  Object  Debris  program  is  indisputable. 
However,  with  two  definitions  of  foreign  objects  -  Process- 
ing Debris  and  Foreign  Object  Debris  -  the  former  is  por- 
trayed as  less  significant  and  dangerous  than  the  latter.  The 
assumption  that  all  debris  will  be  found  before  flight  fails  to 
underscore  the  destructive  potential  of  Foreign  Object  De- 
bris, and  creates  an  incentive  to  simply  accept  "Processing 
Debris." 


Finding: 


F4.2-I8 


Since  2001,  Kennedy  Space  Center  has  used  a 
non-standard  approach  to  define  foreign  object 
debris.  The  industry  standard  term  "Foreign  Ob- 
ject Damage"  has  been  divided  into  two  catego- 
ries, one  of  which  is  much  more  permissive. 


Recommendation: 

R4.2-5  Kennedy  Space  Center  Quality  Assurance  and 
United  Space  Alliance  must  return  to  the  straight- 
forward, industry-standard  definition  of  "Foreign 
Object  Debris."  and  eliminate  any  alternate  or 
statistically  deceptive  definitions  like  "processing 
debris." 
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Endnotes  for  Chapter  4 


The  citotions  that  contain  a  reference  to  "CAIB  document"  with  CAB  or 
CTF  followed  by  seven  to  eleven  digits,  such  as  CAB001-0010,  refer  to  a 
document  in  the  Columbia  Accident  Investigation  Board  database  mointained 
by  the  Department  of  Justice  and  archived  at  the  National  Archives. 

SRB  Forward  Separation  Bolt  Test  Plan,  Document  Number  90ENG- 
OOXX,  April  2,  2003.  CAIB  document  CTF044-62496260. 

"  Cynthia  Furse  and  Randy  Houpt,  "Down  to  the  Wire,"  in  the 
online  version  of  the  IEEE  Spectrum  magazine,  accessed  ot  http:// 
www.spectrum.ieee.org/WEBONLY/publicfeature/feb01/wire.html  on  2 
August  2002. 

'  Boeing  Inspection  Report,  OV-102  J3,  V30/V31  (Wire)  Inspection  Report, 
September  1999-February  2001.  CAIB  document  CTF070-34793501. 

Boeing  briefing,  "Arc  Tracking  Separation  of  Critical  Wiring  Redundancy 
Violations",  present  to  NASA  by  Joe  Daileda  and  Bill  Crawford,  April  18, 
2001.  CAIB  document  CAB033-43774435. 

E-mail  message  from  Jim  Feeley,  Lockheed  Martin,  Michoud  Assembly 
Facility,  April  24,  2003.  This  External  Tank  (ET-93)  was  originally  mated 
to  the  Solid  Rocket  Boosters  and  bipod  struts  in  anticipation  of  an  earlier 
lounch  date  for  mission  STS-107.  Since  Space  Station  missions  require 
the  use  of  a  Super  Light  Weight  Tank,  ET-93  (which  is  a  Light  Weight 
Tank)  had  to  be  de-mated  from  the  Solid  Rocket  Boosters  so  that  they 
could  be  mated  to  such  a  Super  Light  Weight  Tank.  The  mating  of  the 
bipod  struts  to  ET-93  was  performed  in  anticipation  of  an  Orbiter  mate. 
Once  STS-107  was  delayed  and  ET-93  had  to  be  de-mated  from  the  Solid 
Rocket  Boosters,  the  bipod  struts  were  also  de-mated,  since  they  are  not 
designed  to  be  attached  to  the  External  Tank  during  subsequent  Solid 
Rocket  Booster  de-mate/mate  operations. 

''  "Production  Info  -  Splinter  Meeting,"  presented  at  Michoud  Assembly 
Facility,  March  13,  2002.  TSPB  ET-93-ST-003,  "Bipod  Strut  Removal," 
August  1,  2002. 

^  PR  ET-93-TS-00073,  "There  Is  An  Area  Of  Crushed  Foam  From  The 
Installation  Of  The  -Y  Bipod,"  August  8,  2002. 


"Crushed  Foam  Testing."  CAIB  document  CTF059-10561058. 

PR  ET-93-TS-00073,  "There  Is  An  Area  Of  Crushed  Foam  From  The 
Installation  Of  The  -Y  Bipod,"  August  8,  2002;  Meeting  with  John  Blue, 
USA  Engineer,  Kennedy  Space  Center,  March  10,  2003. 

Lockheed  Martin  drawing  80911019109-509,  "BIPOD  INSTL,ET/ 
ORB,FWD" 

"Crushed  Foam  Testing."  CAIB  document  CTF059-10561058. 

Minutes  of  Orbiter  Structures  Telecon  meeting,  June  19,  2001,  held  with 
NASA,  KSC,  USA,  JSC,  BNA-Downey,  Huntington  Beach  and  Palmdale. 
CAIB  document  CAB033-38743888. 

NASA  Report  NSTS-37398. 

Standard  Operating  Procedure,  Foreign  Object  Debris  (FOD)  Reporting, 
Revision  A,  Document  Number  SOP-O-0801-035,  October  1,  2002, 
United  Space  Alliance,  Kennedy  Space  Center,  pg.  3. 

Ibid,  pg.  2. 

"An  effective  FOD  prevention  program  identifies  potential  problems, 
corrects  negative  factors,  provides  awareness,  effective  employee 
training,  and  uses  industry  "lessons  learned"  for  continued  improvement. 
There  is  no  mention  of  Processing  Debris,  but  the  guidance  does  address 
potential  Foreign  Object  Damoge  and  Foreign  Object  Debris.  While 
NASA  has  done  a  good  job  of  complying  with  almost  every  area  of 
this  guideline,  the  document  addresses  Foreign  Object  investigations  in 
o  singular  sense:  "All  incidents  of  actual  or  potential  FOD  should  be 
reported  and  investigated.  These  reports  should  be  directed  to  the  FOD 
Focal  Point  who  should  perform  tracking  and  trending  analysis.  The  focal 
point  should  also  assure  all  affected  personnel  ore  aware  of  all  potential 
(near  mishap)  and  actual  FOD  reports  to  facilitate  feedback  ('lessons 
learned')." 

Space  Flight  Operations  Contract,  Performance  Measurement  System 
Reports  for  January  2003,  February  2003,  USA004840,  issue  014, 
contract  NAS9-2000. 
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The  Accident  Occurred 


Many  accident  investigations  do  not  go  far  enougii.  Tiiey 
identify  the  technical  cause  of  the  accident,  and  then  connect 
it  to  a  variant  of  "operator  error"  -  the  line  worker  who  forgot 
to  insert  the  bolt,  the  engineer  who  miscalculated  the  stress, 
or  the  manager  who  made  the  wrong  decision.  But  this  is  sel- 
dom the  entire  issue.  When  the  determinations  of  the  causal 
chain  are  limited  to  the  technical  flaw  and  individual  failure, 
typically  the  actions  taken  to  prevent  a  similar  event  in  the  fu- 
ture are  also  limited;  fix  the  technical  problem  and  replace  or 
retrain  the  individual  responsible.  Putting  these  corrections  in 
place  leads  to  another  mistake  -  the  belief  that  the  problem  is 
solved.  The  Board  did  not  want  to  make  these  errors. 

Attempting  to  manage  high-risk  technologies  while  mini- 
mizing failures  is  an  extraordinary  challenge.  By  their 
nature,  these  complex  technologies  are  intricate,  with  many 
interrelated  parts.  Standing  alone,  the  components  may  be 
well  understood  and  have  failure  modes  that  can  be  antici- 
pated. Yet  when  these  components  are  integrated  into  a  larg- 
er system,  unanticipated  interactions  can  occur  that  lead  to 
catastrophic  outcomes.  The  risk  of  these  complex  systems  is 
increased  when  they  are  produced  and  operated  by  complex 
organizations  that  also  break  down  in  unanticipated  ways. 

In  our  view,  the  NASA  organizational  culture  had  as  much 
to  do  with  this  accident  as  the  foam.  Organizational  culture 
refers  to  the  basic  values,  norms,  beliefs,  and  practices  that 
characterize  the  functioning  of  an  institution.  At  the  most  ba- 
sic level,  organizational  culture  defines  the  assumptions  that 
employees  make  as  they  carr>  out  their  work.  It  is  a  powerful 
force  that  can  persist  through  reorganizations  and  the  change 
of  key  personnel.  It  can  be  a  positive  or  a  negative  force. 

In  a  report  dealing  with  nuclear  wastes,  the  National  Re- 
search Council  quoted  Alvin  Weinberg's  classic  statement 
about  the  "Faustian  bargain"  that  nuclear  scientists  made 
with  society.  "The  price  that  we  demand  of  society  for  this 
magical  energy  source  is  both  a  vigilance  and  a  longevity  of 
our  social  institutions  that  we  are  quite  unaccustomed  to." 
This  is  also  true  of  the  space  program.  At  NASA's  urging,  the 
nation  committed  to  building  an  amazing,  if  compromised. 


vehicle  called  the  Space  Shuttle.  When  the  agency  did  this, 
it  accepted  the  bargain  to  operate  and  maintain  the  vehicle 
in  the  safest  possible  way.  The  Board  is  not  convinced  that 
NASA  has  completely  lived  up  to  the  bargain,  or  that  Con- 
gress and  the  Administration  has  provided  the  funding  and 
support  necessary  for  NASA  to  do  so.  This  situation  needs  to 
be  addressed  -  if  the  nation  intends  to  keep  conducting  hu- 
man space  flight,  it  needs  to  live  up  to  its  part  of  the  bargain. 

Part  Two  of  this  report  examines  NASA's  organizational, 
historical,  and  cultural  factors,  as  well  as  how  these  factors 
contributed  to  the  accident.  As  in  Part  One,  this  part  begins 
with  history.  Chapter  ."^  examines  the  post-Cluilleii^er  his- 
tory of  NASA  and  its  Human  Space  Flight  Program.  This 
includes  reviewing  the  budget  as  well  as  organizational  and 
management  history,  such  as  shifting  management  systems 
and  locations.  Chapter  6  documents  management  perfor- 
mance related  to  Coliinihia  to  establish  events  analyzed  in 
later  chapters.  The  chapter  reviews  the  foam  strikes,  intense 
schedule  pressure  driven  by  an  artificial  requirement  to  de- 
liver Node  2  to  the  International  Space  Station  by  a  certain 
date,  and  NASA  management's  handling  of  concerns  regard- 
ing Columbia  during  the  STS-107  mission. 

In  Chapter  7,  the  Board  presents  its  views  of  how  high-risk 
activities  should  be  managed,  and  lists  the  characteristics 
of  institutions  that  emphasize  high-reliability  results  over 
economic  efficiency  or  strict  adherence  to  a  schedule.  This 
chapter  measures  the  Space  Shuttle  Program's  organizational 
and  management  practices  against  these  principles  and  finds 
them  wanting.  Chapter?  defines  the  organizational  cause  and 
offers  recommendations.  Chapter  8  draws  from  the  previous 
chapters  on  histoiy.  budgets,  culture,  organization,  and  safety 
practices,  and  analyzes  how  all  these  factors  contributed  to 
this  accident.  This  chapter  captures  the  Board's  views  of  the 
need  to  adjust  management  to  enhance  safety  margins  in 
Shuttle  operations,  and  reaffirms  the  Board's  position  that 
without  these  changes,  we  have  no  confidence  that  other 
"corrective  actions"  will  improve  the  safety  of  Shuttle  opera- 
tions. The  changes  we  recommend  will  be  difficult  to  accom- 
plish -  and  will  be  internally  resisted. 
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Chapter  5 


From  Challenger 
to  Columbia 


The  Board  is  convinced  that  the  factors  that  led  to  the 
Coluinhia  accident  go  well  beyond  the  physical  mechanisms 
discussed  in  Chapter  3.  The  causal  roots  of  the  accident  can 
also  be  traced,  in  part,  to  the  turbulent  post-Cold  War  policy 
environment  in  which  NASA  functioned  during  most  of  the 
years  between  the  destruction  of  Cluilleiiiier  and  the  loss  of 
Coluinhia.  The  end  of  the  Cold  War  in  the  late  1980s  meant 
that  the  most  important  political  underpinning  of  NASA's 
Human  Space  Flight  Program  -  U.S. -Soviet  space  competi- 
tion -  was  lost,  with  no  equally  strong  political  objective  to 
replace  it.  No  longer  able  to  justify  its  projects  with  the  kind 
of  urgency  that  the  superpower  struggle  had  provided,  the 
agency  could  not  obtain  budget  increases  through  the  1990s. 
Rather  than  adjust  its  ambitions  to  this  new  state  of  affairs, 
NASA  continued  to  push  an  ambitious  agenda  of  space 
science  and  exploration,  including  a  costly  Space  Station 
Program. 

If  NASA  wanted  to  carry  out  that  agenda,  its  only  recourse, 
given  its  budget  allocation,  was  to  become  more  efficient, 
accomplishing  more  at  less  cost.  The  search  for  cost  reduc- 
tions led  top  NASA  leaders  over  the  past  decade  to  downsize 
the  Shuttle  workforce,  outsource  various  Shuttle  Program 
responsibilities  -  including  safety  oversight  -  and  consider 
eventual  privatization  of  the  Space  Shuttle  Program.  The 
program's  budget  was  reduced  by  40  percent  in  purchasing 
power  over  the  past  decade  and  repeatedly  raided  to  make 
up  for  Space  Station  cost  overruns,  even  as  the  Program 
maintained  a  launch  schedule  in  which  the  Shuttle,  a  de- 
velopmental vehicle,  was  used  in  an  operational  mode.  In 
addition,  the  uncertainty  of  top  policymakers  in  the  White 
House,  Congress,  and  NASA  as  to  how  long  the  Shuttle 
would  fly  before  being  replaced  resulted  in  the  delay  of 
upgrades  needed  to  make  the  Shuttle  safer  and  to  extend  its 
service  life. 

The  Space  Shuttle  Program  has  been  transformed  since  the 
late  1980s  implementation  of  post-ClHillenf>cr  management 
changes  in  ways  that  raise  questions,  addressed  here  and  in 
later  chapters  of  Part  Two,  about  NASA's  ability  to  safely 


operate  the  Space  Shuttle.  While  it  would  be  inaccurate  to 
say  that  NASA  managed  the  Space  Shuttle  Program  at  the 
time  of  the  Coluinhia  accident  in  the  same  manner  it  did  prior 
to  Challeuiicr,  there  are  unfortunate  similarities  between  the 
agency's  performance  and  safety  practices  in  both  periods. 

5.1    The  Chaiienger  Accident 
AND  ITS  Aftermath 

The  inherently  vulnerable  design  of  the  Space  Shuttle, 
described  in  Chapter  1,  was  a  product  of  policy  and  tech- 
nological compromises  made  at  the  time  of  its  approval  in 
1972.  That  approval  process  also  produced  unreasonable 
expectations,  even  myths,  about  the  Shuttle's  future  per- 
formance that  NASA  tried  futilely  to  fulfill  as  the  Shuttle 
became  "operational"  in  1982.  At  first,  NASA  was  able  to 
maintain  the  image  of  the  Shuttle  as  an  operational  vehicle. 
During  its  early  years  of  operation,  the  Shuttle  launched  sat- 
ellites, perfomied  on-orbit  research,  and  even  took  members 
of  Congress  into  orbit.  At  the  beginning  of  1986,  the  goal  of 
"routine  access  to  space"  established  by  President  Ronald 
Reagan  in  1982  was  ostensibly  being  achieved.  That  appear- 
ance soon  proved  illusory.  On  the  cold  morning  of  January 
28,  1986.  the  Shuttle  Challcni>er  broke  apart  73  seconds  into 
its  climb  towards  orbit.  On  board  were  Francis  R.  Scobee, 
Michael  J.  Smith.  Ellison  S.  Onizuka.  Judith  A.  Resnick, 
Ronald  E.  McNair,  Sharon  Christa  McAuliffe.  and  Gregory 
B.  Jarvis.  All  perished. 

Rogers  Commission 

On  February  3,  1 986,  President  Reagan  created  the  Presiden- 
tial Commission  on  the  Space  Shuttle  Challenger  Accident, 
which  soon  became  known  as  the  Rogers  Commission  after 
its  chairman,  former  Secretary  of  State  William  Rogers.  The 
Commission's  report,  issued  on  June  6,  1986,  concluded  that 
the  loss  of  Challeniicr  was  caused  by  a  failure  of  the  joint 
and  seal  between  the  two  lower  segments  of  the  right  Solid 
Rocket  Booster.  Hot  gases  blew  past  a  rubber  0-ring  in  the 
joint,  leading  to  a  structural  failure  and  the  explosive  bum- 
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ing  of  the  Shuttle's  hydrogen  fuel.  While  the  Rogers  Com- 
mission identified  the  failure  of  the  Solid  Rocket  Booster 
joint  and  seal  as  the  physical  cause  of  the  accident,  it  also 
noted  a  number  of  NASA  management  failures  that  contrib- 
uted to  the  catastrophe. 

The  Rogers  Commission  concluded  "the  decision  to  launch 
the  Chdlleiiiier  was  flawed."  Communication  failures, 
incomplete  and  misleading  information,  and  poor  manage- 
ment judgments  all  figured  in  a  decision-making  process 
that  permitted,  in  the  words  of  the  Commission,  "internal 
flight  safety  problems  to  bypass  key  Shuttle  inanagers."  As 
a  result,  if  those  making  the  launch  decision  "had  known  all 
the  facts,  it  is  highly  unlikely  that  they  would  have  decided 
to  launch."  Far  from  meticulously  guarding  against  potential 
problems,  the  Commission  found  that  NASA  had  required 
"a  contractor  to  prove  that  it  was  not  safe  to  launch,  rather 
than  proving  it  was  safe."' 

The  Commission  also  found  that  NASA  had  missed  warn- 
ing signs  of  the  impending  accident.  When  the  joint  began 
behaving  in  unexpected  ways,  neither  NASA  nor  the  Solid 
Rocket  Motor  manufacturer  Morton-Thiokol  adequately 
tested  the  joint  to  determine  the  source  of  the  deviations 
from  specifications  or  developed  a  solution  to  them,  even 
though  the  problems  frequently  recun-ed.  Nor  did  they  re- 
spond to  internal  warnings  about  the  faulty  seal.  Instead, 
Morton-Thiokol  and  NASA  management  came  to  see  the 
problems  as  an  acceptable  flight  risk -a  violation  of  a  design 
requirement  that  could  be  tolerated. - 

During  this  period  of  increasing  uncertainty  about  the  joint's 
performance,  the  Commission  found  that  NASA's  safety 
system  had  been  "silent."  Of  the  management,  organiza- 
tional, and  communication  failures  that  contributed  to  the 
accident,  four  related  to  faults  within  the  safety  system, 
including  "a  lack  of  problem  reporting  requirements,  inad- 
equate trend  analysis,  misrepresentation  of  criticality,  and 
lack  of  involvement  in  critical  discussions."'  The  checks 
and  balances  the  safety  system  was  meant  to  provide  were 
not  working. 

Still  another  factor  influenced  the  decisions  that  led  to  the 
accident.  The  Rogers  Commission  noted  that  the  Shuttle's 
increasing  flight  rate  in  the  mid-1980s  created  .schedule 
pressure,  including  the  compression  of  training  schedules, 
a  shoitage  of  spare  parts,  and  the  focusing  of  resources  on 
near-term  problems.  NASA  managers  "may  have  forgot- 
ten-partly  because  of  past  success,  partly  because  of  their 
own  well-nurtured  image  of  the  program-that  the  Shuttle 
was  still  in  a  research  and  development  phase."'* 

The  Challenger  accident  had  profound  effects  on  the  U.S. 
space  program.  On  August  15,  1986,  President  Reagan  an- 
nounced that  "NASA  will  no  longer  be  in  the  business  of 
launching  private  satellites."  The  accident  ended  Air  Force 
and  intelligence  community  reliance  on  the  Shuttle  to  launch 
national  security  payloads,  prompted  the  decision  to  aban- 
don the  yet-to-be-opened  Shuttle  launch  site  at  Vandenberg 
Air  Force  Base,  and  forced  the  development  of  improved 
expendable  launch  vehicles.'' A  1992  White  House  advisory 
committee  concluded  that  the  recovery  frtim  the  Ciicilleitfier 


Selected  Rogers  Commission 
Recommendations 


•  "The  faulty  Solid  Rocket  Motor  joint  and  seal  must" 
be  changed.  This  could  be  a  new  design  eliminating 
the  joint  or  a  redesign  of  the  current  joint  and  seal.  No 
design  options  should  be  prematurely  precluded  because 
of  schedule,  cost  or  reliance  on  existing  hardware.  All 
Solid  Rocket  Motor  joints  should  satisfy  the  following: 

•  "The  joints  should  be  fully  understood,  tested  and 
verified." 

•  "The  certitication  of  the  new  design  should  include: 

•  Tests  which  duplicate  the  actual  launch  configu- 
■     radon  as  closely  as  possible. 

•  Tests  over  the  full  range  of  operating  conditions, 
including  temperature." 

•  "Full  consideration  should  be  given  to  conducting  static 
firings  of  the  exact  flight  configuration  in  a  vertical  at- 
titude." 

•  "The  Shuttle  Program  Structure  should  be  reviewed. 
The  project  managers  for  the  various  elements  of  the 
Shuttle  program  felt  more  accountable  to  their  center 
management  than  to  the  Shuttle  program  organization." 

•  "NASA  should  encourage  the  transition  of  qualified 
astronauts  into  agency  management  positions." 

•  "NASA  should  establish  an  Office  of  Safety.  Reliability 
and  Quality  Assurance  to  be  headed  by  an  Associate  Ad- 
ministrator, reporting  directly  to  the  NASA  Administra- 
tor It  would  have  direct  authority  for  safety,  reliability, 
and  quality  assurance  throughout  the  agency.  The  office 
should  be  assigned  the  work  force  to  ensure  adequate 
oversight  of  its  functions  and  should  be  independent  of 
other  NASA  functional  and  program  responsibilities." 

•  "NASA  should  establish  an  STS  Safety  Advisory  Panel 
reporting  to  the  STS  Program  Manager.  The  charter  of 
this  panel  should  include  Shuttle  operational   issues, 
launch  commit  criteria,  flight  rules,  flight  readiness  and    > 
risk  management." 

•  "The  Commission  found  that  Marshall  Space  Flight 
Center  project  managers,  because  of  a  tendency  at 
Marshall  to  management  isolation,  failed  to  provide  full 
and  timely  infomiation  bearing  on  the  safety  of  flight 
51-L  I  the  Challenger  mission]  to  other  vital  elements 
of  Shuttle  program  management  ...  NASA  should  take 
energetic  steps  to  eliminate  this  tendency  at  Marshall 
Space  Flight  Center,  whether  by  changes  of  personnel, 
organization,  indoctrination  or  all  three."" 

•  "The  nation"s  reliance  on  the  Shuttle  as  its  principal  ._ 
space  launch  capability  created  a  relentless  pressure  on  •. 
NASA  to  increase  the  flight  rate  ...  NASA  must  estab-  ': 
lish  a  flight  rate  that  is  consistent  v\'ith  its  resources."^        ^ 

disaster  cost  the  country  $  1 2  billion,  which  included  the  cost 
of  building  the  replacement  Orbiter  Endeavour." 

It  took  NASA  32  months  after  the  Challenger  accident  to 
redesign  and  requalify  the  Solid  Rocket  Booster  and  to  re- 
turn the  Shuttle  to  flight.  The  first  post-accident  flight  was 
launched  on  September  29,  1988.  As  the  Shuttle  returned 
to  flight,  NASA  Associate  Administrator  for  Space  Flight 
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Richard  Truly  commented.  "We  will  always  have  to  treat 
it  (the  Shuttle]  like  an  R&D  test  program,  even  many  years 
into  the  future.  1  don't  think  calling  it  operational  fooled 
anybody  within  the  program  ...  It  was  a  signal  to  the  public 
that  shouldn't  have  been  sent."" 

The  Shuttle  Program  After  Return  to  Flight 

.After  the  Rogers  Commission  report  was  issued.  NASA  made 
many  of  the  organizational  changes  the  Commission  recom- 
mended. The  space  agency  mov  ed  management  of  the  Space 
Shuttle  Program  from  the  Johnson  Space  Center  to  N.'XSA 
Headquarters  in  Washington.  D.C.  The  intent  of  this  change 
was  to  create  a  management  structure  "resembling  that  of  the 
.-Xpollo  program,  with  the  aim  of  preventing  communication 
deficiencies  that  contributed  to  the  Cluillen^er  accident.'"' 
NASA  also  established  an  Office  of  Safety.  Reliability,  and 
Quality  Assurance  at  its  Headquarters,  though  that  office  was 
not  given  the  "direct  authority"  over  all  of  NASA's  safety 
operations  as  the  Rogers  Commission  had  recommended. 
Rather.  NASA  human  space  flight  centers  each  retained  their 
own  safety  organization  reporting  to  the  Center  Director. 

In  the  almost  15  years  between  the  return  to  flight  and  the 
loss  of  Coliimhia.  the  Shuttle  was  again  being  used  on  a 
regular  basis  to  conduct  space-based  research,  and.  in  line 
with  NASA's  original  1969  vision,  to  build  and  service 
a  space  station.  The  Shuttle  tlew  87  missions  during  this 
period,  compared  to  24  before  CliaUeiiiicr.  Highlights  from 
these  missions  include  the  1990  launch,  1993  repair,  and 
1999  and  2002  servicing  of  the  Hubble  Space  Telescope: 
the  launch  of  several  major  planetary  probes;  a  number  of 
Shuttle-Spacelab  missions  devoted  to  scientific  research: 
nine  missions  to  rendezvous  with  the  Russian  space  station 
Mir;  the  return  of  former  Mercui^  astronaut  Senator  John 
Glenn  to  orbit  in  October  1998:  and  the  launch  of  the  first 
U.S.  elements  of  the  International  Space  Station. 

After  the  Cluillenfier  accident,  the  Shuttle  was  no  longer 
described  as  "operational"  in  the  same  sense  as  commercial 
aircraft.  Nevertheless.  NASA  continued  planning  as  if  the 
Shuttle  could  be  readied  for  launch  at  or  near  whatever  date 
was  set.  Tying  the  Shuttle  closely  to  International  Space 
Station  needs,  such  as  crew  rotation,  added  to  the  urgency 
of  maintaining  a  predictable  launch  schedule.  The  Shuttle 
is  currently  the  only  means  to  launch  the  already-built 
European,  Japanese,  and  remaining  U.S.  modules  needed 
to  complete  Station  assembly  and  to  carry  and  return  most 
experiments  and  on-orbit  supplies.'"  Even  after  three  occa- 
sions when  technical  problems  grounded  the  Shuttle  fleet 
for  a  month  or  more,  NASA  continued  to  assume  that  the 
Shuttle  could  regularly  and  predictably  service  the  Sta- 
tion. In  recent  years,  this  coupling  between  the  Station  and 
Shuttle  has  become  the  primary  driver  of  the  Shuttle  launch 
schedule.  Whenever  a  Shuttle  launch  is  delayed,  it  impacts 
Station  assembly  and  operations. 

In  September  2001.  testimony  on  the  Shuttle's  achieve- 
ments during  the  preceding  decade  by  NASA's  then-Deputy 
Associate  Administrator  for  Space  Flight  William  Readdy 
indicated  the  assumptions  under  which  NASA  was  operat- 
ing during  that  period: 


The  Space  Shuttle  has  made  dramatic  improvements  in 
the  capahilities.  operations  and  safety  of  the  system. 
The  payload-to-orhit  performance  of  the  Space  Shuttle 
has  been  significantly  improved  -  hy  over  70  percent  to 
the  Space  Station.  The  safery  of  the  Space  Shuttle  has 
also  been  dramatically  improved  hy  reducinf>  risk  hy 
more  than  a  factor  of  five.  In  addition,  the  operahility 
of  the  .system  has  been  significantly  improved,  with  five 
minute  launch  windows  -  which  would  not  have  been 
attempted  a  decade  ago  -  now  becoming  routine.  This 
record  of  success  is  a  testament  to  the  cpiality  and 
dedication  of  the  Space  Shuttle  management  team  and 
workforce,  both  civil  servants  and  contractors." 

5.2    The  NASA  Human  Space  Flight  Culture 

Though  NASA  underwent  many  management  reforms  in 
the  wake  of  the  Challenger  accident  and  appointed  new 
directors  at  the  Johnson.  Marshall,  and  Kennedy  centers,  the 
agency's  powerful  human  space  flight  culture  remained  in- 
tact, as  did  many  institutional  practices,  even  if  in  a  modified 
form.  As  a  close  observer  of  NASA's  organizational  culture 
has  observed.  "Cultural  norms  tend  to  be  fairly  resilient  ... 
The  norms  bounce  back  into  shape  after  being  stretched  or 
bent.  Beliefs  held  in  common  throughout  the  organization 
resist  alteration."''  This  culture,  as  will  become  clear  across 
the  chapters  of  Part  Two  of  this  report,  acted  over  time  to  re- 
sist externally  imposed  change.  By  the  eve  of  the  Columbia 
accident,  institutional  practices  that  were  in  effect  at  the  time 
of  the  Challenger  accident  -  such  as  inadequate  concent 
over  deviations  from  expected  perfonnance,  a  silent  safety 
program,  and  schedule  pressure  -  had  returned  to  NASA. 


Organizational  Culture 

Organizational  culture  refers  to  the  basic  values,  norms, 
beliefs,  and  practices  that  characterize  the  functioning  of  a 
particular  institution.  At  the  most  basic  level,  organizational 
culture  defines  the  assumptions  that  employees  make  as  they 
carp,  out  their  work;  it  defines  "the  way  we  do  things  here." 
An  organization's  culture  is  a  powerful  force  that  persists 
through  reorganizations  and  the  departure  of  key  personnel. 


The  human  space  flight  culture  within  NASA  originated  in 
the  Cold  War  environment.  The  space  agency  itself  was  cre- 
ated in  1958  as  a  response  to  the  Soviet  launch  of  Sputnik, 
the  first  artificial  Earth  satellite.  In  1961,  President  John  F. 
Kennedy  charged  the  new  space  agency  with  the  task  of 
reaching  the  moon  before  the  end  of  the  decade,  and  asked 
Congress  and  the  American  people  to  commit  the  immense 
resources  for  doing  so,  even  though  at  the  time  NASA  had 
only  accumulated  15  minutes  of  human  space  flight  experi- 
ence. With  its  efforts  linked  to  U.S. -Soviet  competition  for 
global  leadership,  there  was  a  sense  in  the  NASA  workforce 
that  the  agency  was  engaged  in  a  historic  struggle  central  to 
the  nation's  agenda. 

The  Apollo  era  created  at  NASA  an  exceptional  "can-do" 
culture  marked  by  tenacity  in  the  face  of  seemingly  impos- 
sible challenues.  This  culture  valued  the  interaction  among 
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research  and  testing,  hands-on  engineering  experience,  and 
a  dependence  on  the  exceptional  quality  of  the  its  workforce 
and  leadership  that  provided  in-house  technical  capability  to 
oversee  the  work  of  contractors.  The  culture  also  accepted 
risk  and  failure  as  inevitable  aspects  of  operating  in  space, 
even  as  it  held  as  its  highest  value  attention  to  detail  in  order 
to  lower  the  chances  of  failure. 

The  dramatic  Apollo  II  lunar  landing  in  July  1969  fixed 
NASA's  achievements  in  the  national  consciousness,  and 
in  history.  However,  the  numerous  accolades  in  the  wake 
of  the  moon  landing  also  helped  reinforce  the  NASA  staff's 
faith  in  their  organizational  culture.  Apollo  successes  created 
the  powerful  image  of  the  space  agency  as  a  "perfect  place," 
as  "the  best  organization  that  human  beings  could  create  to 
accomplish  selected  goals.""  During  Apollo,  NASA  was  in 
many  respects  a  highly  successful  organization  capable  of 
achieving  seemingly  impossible  feats.  The  continuing  image 
of  NASA  as  a  "perfect  place"  in  the  years  after  Apollo  left 
NASA  employees  unable  to  recognize  that  NASA  never  had 
been,  and  .still  was  not.  perfect,  nor  was  it  as  symbolically 
important  in  the  continuing  Cold  War  struggle  as  it  had  been 
for  its  first  decade  of  existence.  NASA  personnel  maintained 
a  vision  Qf  their  agency  that  was  rooted  in  the  glories  of  an 
earlier  time,  even  as  the  world,  and  thus  the  context  within 
which  the  space  agency  operated,  changed  around  them. 

As  a  result,  NASA's  human  space  flight  culture  never  fully 
adapted  to  the  Space  Shuttle  Program,  with  its  goal  of  rou- 
tine access  to  space  rather  than  further  exploration  beyond 
low-Eailh  orbit.  The  Apollo-era  organizational  culture  came 
to  be  in  tension  with  the  more  bureaucratic  space  agency  of 
the  1970s,  whose  focus  turned  from  designing  new  space- 
craft at  any  expense  to  repetitively  flying  a  reusable  vehicle 
on  an  ever-tightening  budget.  This  trend  toward  bureaucracy 
and  the  as.sociated  increased  reliance  on  contracting  neces- 
sitated more  effective  communications  and  more  extensive 
safety' oversight  processes  than  had  been  in  place  during  the 
Apollo  era,  but  the  Rogers  Commission  found  that  such  fea- 
tures were  lacking. 

In  the  aftermath  of  the  Challenger  accident,  these  contra- 
dictory forces  prompted  a  resistance  to  externally  imposed 
changes  and  an  attempt  to  maintain  the  internal  belief  that 
NASA  was  still  a  "perfect  place,"  alone  in  its  ability  to 
execute  a  program  of  human  space  flight.  Within  NASA 
centers,  as  Human  Space  Flight  Program  managers  strove  to 
maintain  their  view  of  the  organization,  they  lost  their  ability 
to  accept  criticism,  leading  them  to  reject  the  recommenda- 
tions of  many  boards  and  blue-ribbon  panels,  the  Rogers 
Commission  among  them. 

External  criticism  and  doubt,  rather  than  spurring  N.ASA  to 
change  for  the  better,  instead  reinforced  the  will  to  "impose 
the  party  line  vision  on  the  environment,  not  to  reconsider 
it,"  according  to  one  authority  on  organizational  behavior 
This  in  turn  led  to  "flawed  decision  making,  self  deception, 
introversion  and  a  diminished  curiosity  about  the  world 
outside  the  perfect  place. "'^  The  NASA  human  space  flight 
culture  the  Board  found  during  its  investigation  manifested 
many  of  these  characteristics,  in  particular  a  self-confidence 
about  NASA  possessing  unique  knowledge  about  how  to 


safely  launch  people  into  space. '^  As  will  be  discussed  later 
in  this  chapter,  as  well  as  in  Chapters  6,  7,  and  8,  the  Board 
views  this  cultural  resistance  as  a  fundamental  impediment 
to  NASA's  effective  organizational  performance. 

5.3    An  Agency  Trying  to  Do  Too  Much 
With  Too  Little 

A  strong  indicator  of  the  priority  the  national  political  lead- 
ership assigns  to  a  federally  funded  activity  is  its  budget.  By 
that  criterion,  NASA's  space  activities  have  not  been  high 
on  the  list  of  national  priorities  over  the  pa.st  three  decades 
(see  Figure  5.3-1 ).  After  a  peak  during  the  Apollo  program, 
when  NASA's  budget  was  almost  four  percent  of  the  federal 
budget,  NASA's  budget  since  the  early  1970s  has  hovered  at 
one  percent  of  federal  spending  or  less. 


Figure  5.3-1.  NASA  boc/gef  as  a  percenfoge  of  fhe  Federal  bud- 
get. (Source:  NASA  History  Office) 


Particularly  in  recent  years,  as  the  national  leadership  has 
confronted  the  challenging  task  of  allocating  scarce  public 
resources  across  many  competing  demands,  NASA  has 
had  difficulty  obtaining  a  budget  allocation  adequate  to  its 
continuing  ambitions.  In  1990,  the  White  House  chartered  a 
blue-ribbon  committee  chaired  by  aerospace  executive  Nor- 
man Augustine  to  conduct  a  sweeping  review  of  NASA  and 
its  programs  in  response  to  Shuttle  problems  and  the  flawed 
mirror  on  the  Hubble  Space  Telescope."'  The  review  found 
that  NASA's  budget  was  inadequate  for  all  the  programs 
the  agency  was  executing,  saying  that  "NASA  is  currently 
over  committed  in  terms  of  program  obligations  relative  to 
resources  available-in  short,  it  is  trying  to  do  too  much,  and 
allowing  too  little  margin  for  the  unexpected."'^  "A  reinvigo- 
rated  space  program,"  the  Augustine  committee  went  on  to 
say,  "will  require  real  growth  in  the  NASA  budget  of  approx- 
imately 10  percent  per  year  (through  the  year  2000)  reaching 
a  peak  spending  level  of  about  $30  billion  per  year  (in  con- 
stant 1990  dollars)  by  about  the  year  2000."  Translated  into 
the  actual  dollars  of  Fiscal  Year  2000,  that  recommendation 
would  have  meant  a  NASA  budget  of  over  $40  billion;  the 
actual  NASA  budget  for  that  year  was  $  1 3.6  billion."' 

During  the  past  decade,  neither  the  White  House  nor  Con- 
gress has  been  interested  in  "a  reinvigorated  space  program." 
Instead,  the  goal  has  been  a  program  that  would  continue  to 
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produce  valuable  scientific  and  symbolic  payoffs  for  the  na- 
tion without  a  need  for  increased  budgets.  Recent  budget  al- 
locations reflect  this  continuing  policy  reality.  Between  1993 
and  2002.  the  government's  discretionary  spending  grew  in 
purchasing  power  by  more  than  25  percent,  defense  spend- 
ing by  \5  percent,  and  non-defense  spending  by  40  percent 
(see  Figure  5.3-2).  NASA's  budget,  in  comparison,  showed 
little  change,  going  from  .$14.31  billion  in  Fi.scal  Year  1993 
to  a  low  of  $13.6  billion  in  Fiscal  Year  2000.  and  increas- 
ing to  $14.87  billion  in  Fiscal  Year  2002.  This  represented  a 
loss  of  13  percent  in  purchasing  power  over  the  decade  (see 
Figure  5.3-3).'" 


1993   FY  1994  FY  1995   FY  1996   FY  1997   FY  1998  FY  1999   FY  2000   FY  2001   FY  2002 


Figure  5.3-2.   Changes  in   Federal  spending  from    7993   through 
2002.  (Source:  NASA  Office  of  tegis/ofiVe  Affairs) 


Fiscal  Year 
1965 

Real  Dollars 
(in  mi//ionsj 

Consfanf  Do//ars 
(m  FY  2002  mi7/,onsj 

5,250 

24,696 

1975 

3,229 

10,079 

11,643 

1985 

7,573 

1993 

14,310 

17,060 

1994 

14,570 

16,965 

1995 

13,854 

15,790 

1996 

13,884 

15,489 

1997 
1998 

13,709 
13,648 

14,994 
14,641 

1999 

13,653 
13,601 

14,443 
14,202 

2000 

2001 

14,230 

14,559 
14,868 

2002 

14,868 

2003 

15,335 

NA 

2004 

(requested) 
15,255 

NA 

Figure  5.3-3.   NASA  Budget.   (Source:  NASA  and  OfFice  of  Mon- 
ogemenf  and  Budget) 


The  lack  of  top-level  interest  in  the  space  program  led  a 
2002  review  of  the  U.S.  aerospace  sector  to  observe  that 
"a  sense  of  lethargy  has  affected  the  space  industry  and 
community,  instead  of  the  excitement  and  exuberance  that 
dominated  our  early  ventures  into  space,  we  at  times  seem 
almost  apologetic  about  our  continued  investments  in  the 
space  program."-" 

What  the  Experts  Have  Said 

Warnings  of  a  Shuttle  Accident 

"Shuttle  reliability  is  uncertain,  hut  has  been  estimated  to 
range  between  97  and  99  percent.  If  the  Shuttle  reliability 
is  98  percent,  there  would  he  a  50-50  chance  oflosin,^  an 
Orhiter  within  34  flights  . . .  The  probability  ofnuiintainina 
at  least  three  Orbiters  in  the  Shuttle  fleet  declines  to  less 
than  50  percent  after  flight  113."-' 

-The  Office  of  Technology  Assessment.  1989 

"And  although  it  is  a  subject  that  meets  with  reluctance 
to  open  discussion,  and  has  therefore  loo  often  been 
relegated  to  silence,  the  stalislicat  evidoice  indicates 
that  we  are  likely  to  lose  another  Space  Shuttle  in  the 
ne.vt  several  years  . . .  probably  before  the  planned  Space 
Station  is  completely  established  on  orbit.  This  would  seem 
to  be  the  weak  link  of  the  civil  space  program  -  unpleasant 
to  recognize,  involving  all  the  uncertainties  of  statistics. 
and  difficult  to  resolve. " 

-The  Augustine  Committee.  1990 

Shuffle  as  Developmenfal  Vehicle 

"Shuttle  is  also  a  complex  system  that  has  yet  to 
demonstrate  an  ability  to  adhere  to  a  fi.xed  .schedule  " 

-The  Augustine  Committee.  1990 

NASA  Human  Space  Flight  Culture 

"NASA  has  not  been  sufficiently  responsive  to  valid 
criticism  and  the  need  for  change.  "'- 

-The  Augustine  Committee.  1990 


Faced  with  this  budget  situation.  NASA  had  the  choice  of 
either  eliminating  major  prograttis  or  achieving  greater  effi- 
ciencies while  maintaining  its  existing  agenda.  Agency  lead- 
ers chose  to  attempt  the  latter.  They  continued  to  develop 
the  space  station,  continued  robotic  planetary  and  scientific 
missions,  and  continued  Shuttle-based  missions  for  both  sci- 
entific and  symbolic  purposes.  In  1994  they  took  on  the  re- 
sponsibility for  developing  an  advanced  technology  launch 
vehicle  in  partnership  with  the  private  sector.  They  tried  to 
do  this  by  becoming  more  efficient.  "Faster,  better,  cheaper" 
became  the  NASA  slogan  of  the  1990s.-' 

The  flat  budget  at  NASA  particularly  affected  the  hu- 
man space  flight  enterprise.  During  the  decade  before  the 
Cohmihia  accident.  NASA  rebalanced  the  share  of  its  bud- 
get allocated  to  human  space  flight  from  48  percent  of  agen- 
cy funding  in  Fiscal  Year  1991  to  38  percent  in  Fiscal  Year 
1 999.  with  the  remainder  going  mainly  to  other  science  and 
technology  effoits.  On  NASA's  fixed  budget,  that  meant 
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Earmarks 

Pressure  on  NASA's  budget  has  come  not  only  Ironi  the 
White  House,  but  also  from  the  Congress.  In  recent  years 
there  has  been  an  increasing  tendency  for  the  Congress 
to  add  "earmarks"  -  congressional  additit)ns  to  the  NASA 
budget  request  that  reflect  targeted  Members'  interests.  These 
earmarks  come  out  of  already-appropriated  funds,  reducing 
the  amounts  available  for  the  original  tasks.  For  example,  as 
Congress  considered  NASA's  Fiscal  Year  2002  appropriation, 
the  NASA  Administrator  told  the  House  Appropriations 
subcommittee  with  jurisdiction  over  the  NASA  budget 
that  the  agency  was  "extremely  concerned  regarding  the 
magnitude  and  number  of  congressional  earmarks"  in  the 
House  and  Senate  versions  of  the  NASA  appropriations  bill.-"* 
He  noted  "the  total  number  of  House  and  Senate  earmarks  . . . 
is  approximately  140  separate  items,  an  increase  of  nearly 
50  percent  over  FY  2001."  These  earmarks  reHecied  "an 
increasing  fraction  of  items  that  circumvent  the  peer  review 
process,  or  involve  construction  or  other  objectives  that  have 
no  relation  to  NASA  mission  objectives."  The  potential 
Fiscal  Year  2002  earmarks  represented  "a  net  total  of  $540 
million  in  reductions  to  ongoing  NASA  programs  to  fund  this 
extremely  large  number  of  earmarks.'"-'' 


the  Space  Shuttle  and  the  International  Space  Station  were 
competing  for  decreasing  resources.  In  addition,  at  least 
$650  million  of  NASA's  human  space  flight  budget  was 
used  to  purchase  Russian  hardware  and  services  related  to 
U.S. -Russian  space  cooperation.  This  initiative  was  largely 
driven  by  the  Clinton  Administration's  foreign  policy  and 
national  security  objectives  of  supporting  the  administra- 


tion of  Boris  Yeltsin  and  halting  the  proliferation  of  nuclear 
weapons  and  the  means  to  deliver  them. 

Space  Shuttle  Program  Budget  Patterns 

For  the  past  30  years,  tiie  Space  Shuttle  Program  has  been 
NASA's  single  most  expensive  activity,  and  of  all  NASA's 
efforts,  that  program  has  been  hardest  hit  by  the  budget  con- 
straints of  the  past  decade.  Given  the  high  priority  assigned 
after  1993  to  completing  the  costly  International  Space  Sta- 
tion, NASA  managers  have  had  little  choice  but  to  attempt 
to  reduce  the  costs  of  operating  the  Space  Shuttle.  This 
left  little  funding  for  Shuttle  improvements.  The  squeeze 
on  the  Shuttle  budget  was  even  more  severe  after  the  Of- 
fice of  Management  and  Budget  in  1994  insisted  that  any 
cost  overrinis  in  the  international  Space  Station  budget  be 
made  up  from  within  the  budget  allocation  for  human  space 
flight,  rather  than  from  the  agency's  budget  as  a  whole.  The 
Shuttle  was  the  only  other  large  program  within  that  budget 
category. 

Figures  5.3-4  and  5.3-5  show  the  traJectoi7  of  the  Shuttle 
budget  over  the  past  decade.  In  Fiscal  Year  1993,  the  out- 
going Bush  administration  requested  $4,128  billion  for  the 
Space  Shuttle  Program;  five  years  later,  the  Clinton  Admin- 
istration request  was  for  $2,977  billion,  a  27  percent  reduc- 
tion. By  Fiscal  Year  2003,  the  budget  request  had  increased 
to  $3,208  billion,  still  a  22  percent  reduction  from  a  decade 
earlier.  With  inflation  taken  into  account,  over  the  past  de- 
cade, there  has  been  a  reduction  of  approximately  40  percent 
in  the  purchasing  power  of  the  program's  budget,  compared 
to  a  reduction  of  13  percent  in  the  NASA  budget  overall. 


Fiscal  Year 

President's 
Request  to 
Congress 

Congressional 
Appropriation 

Change 

NASA 
Operating  Plan  * 

Change 

1993 

4,128.0 

4,078.0 

-50.0 

4,052.9 

-25.1 

1994 

4,196.1 

3,778.7 

-417.4** 

3,772.3 

-6.4 

1995 

3,324.0 

3,155.1 

-168.9 

3,155.1 

0.0 

1996 

3,231.8 

3,178.8 

-53.0 

3,143.8 

-35.0 

1997 

3,150.9 

3,150.9 

0.0 

2,960.9 

-190.0 

1998 

2,977.8 

2,9278 

-50.0 

2,912.8 

-15.0 

1999 

3,059.0 

3,028.0 

-31.0 

2,998.3 

-29.7 

2000 

2,986.2 

3,011.2 

+25.0 

2,984.4 

-26.8 

2001 

3,165.7 

3,125.7 

-40.0 

3,118.8 

-6.9 

2002 

3,283.8 

3,278.8 

-5,0 

3,270.0 

-8.9 

2003 

3,208.0 

3,252.8 

+44.8 

Figure  5.3-4.  Space  Shuttle  Program  Budget  (in  millions  of  dollars).  (Source:  NASA  Office  of  Space  Flight) 

*  NASA's  operating  plan  is  the  means  for  adjusting  congressional  appropriations  among  various  ocfivifies  during  the  Fiscal  year  as  changing 
circumstances  dictate.  These  changes  must  be  approved  by  NASA's  appropriation  sutcommiftees  before  they  can  be  put  into  effect. 
**This  reduction  primarily  reflects  the  congressional  cancellation  of  the  Advanced  Solid  Rocket  Motor  Program 
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Figure  5.3-5.  NASA  budget  as  a  percentage  of  the  Federal  budget 
from  1991  to  2008.  (Source;  NASA  Office  of  Space  Flight) 


This  budget  squeeze  also  came  at  a  time  when  the  Space 
Shuttle  Program  exhibited  a  trait  common  to  most  aging 
systems:  increased  costs  due  to  greater  maintenance  require- 
ments, a  declining  second-  and  third-tier  contractor  support 
base,  and  deteriorating  infrastructure.  Maintaining  the  Shut- 
tle was  becoming  more  expensive  at  a  time  when  Shuttle 
budgets  were  decreasing  or  being  held  constant.  Only  in  the 
last  few  years  have  those  budgets  begun  a  gradual  increase. 

As  Figure  5.3-5  indicates,  most  of  the  steep  reductions  in 
the  Shuttle  budget  date  back  to  the  first  half  of  the  1990s. 
In  the  second  half  of  the  decade,  the  White  House  Office 
of  Management  and  Budget  and  NASA  Headquarters  held 
the  Shuttle  budget  relatively  level  by  deferring  substantial 
funding  for  Shuttle  upgrades  and  infrastructure  improve- 
ments, while  keeping  pressure  on  NASA  to  limit  increases 
in  operating  costs. 

5.4    Turbulence  in  NASA  Hits  the  Space 
SHuniE  Program 

In  1992  the  White  House  replaced  NASA  Administrator 
Richard  Truly  with  aerospace  executive  Daniel  S.  Goldin. 
a  self-proclaimed  "agent  of  change"  who  held  office  from 
April  1,  1992.  to  November  17,  2001  (in  the  process  be- 
coming the  longest-serving  NASA  Administrator).  Seeing 
"space  exploration  (manned  and  unmanned)  as  NASA's 
principal  purpose  with  Mars  as  a  destiny."  as  one  man- 
agement scholar  observed,  and  favoring  "administrative 
transformation"  of  NASA,  Goldin  engineered  "not  one  or 
two  policy  changes,  but  a  torrent  of  changes.  This  was  not 
evolutionar>'  change,  but  radical  or  discontinuous  change."-" 
His  tenure  at  NASA  was  one  of  continuous  turmoil,  to  which 
the  Space  Shuttle  Program  was  not  immune. 

Of  course,  turbulence  does  not  necessarily  degrade  organi- 
zational performance.  In  some  cases,  it  accompanies  pro- 
ductive change,  and  that  is  what  Goldin  hoped  to  achieve. 
He  believed  in  the  management  approach  advocated  by  W. 
Edwards  Deming.  who  had  developed  a  series  of  widely 
acclaimed  management  principles  based  on  his  work  in 
Japan  during  the  "economic  miracle"  of  the  1980s.  Goldin 
attempted  to  apply  some  of  those  principles  to  NASA, 
including  the  notion  that  a  corporate  headquarters  should 


Congressional  Budget  Reductions 

In  most  years.  Congress  appropriates  slightly  less  for  the 
Space  Shuttle  Program  than  the  President  requested:  in  some 
cases,  these  reductions  have  been  requested  b>  NASA  during 
the  final  stages  of  budget  deliberations.  After  its  budget  was 
passed  by  Congress.  NASA  furliier  reduced  the  Shuttle 
budget  in  the  agency's  operating  plan-the  plan  by  which 
NASA  actually  allocates  its  appropriated  budget  during 
the  fiscal  year  to  react  to  changing  program  needs.  These 
released  funds  were  allocated  to  other  activities,  both  within 
the  human  space  flight  program  and  in  other  parts  of  the 
agency.  Changes  in  recent  years  include: 

Fiscal  Year  1997 

•  NASA  transferred  $190  million  to  International  Space 
Station  (ISS). 

Fiscal  Year  1998 

•  At  NASA's  request.  Congress  transfencd  $50  million  to 
ISS. 

•  NASA  transferred  $15  million  to  ISS. 

Fiscal  Year  1999 

•  At  NASA's  request.  Congress  reduced  Shuttle  $.^1  mil- 
lion so  NASA  could  fund  other  requirements. 

•  NASA  reduced  Shuttle  $32  million  bv  deferring  two 
flights:  funds  transferred  to  ISS. 

•  NASA  added  $2..^  million  from  ISS  to  previous  NASA 
request. 

Fiscal  Year  2000 

•  Congress  added  $25  million  to  Shuttle  budget  for  up- 
grades and  transferred  $25  million  from  operations  to 
upgrades. 

•  NASA  reduced  Shuttle  $11. 5  million  per  government- 
wide  rescission  requirement  and  transferred  $15..^  mil- 
lion to  ISS. 

Fiscal  Year  2001 

•  At  NASA's  request,  Conjiress  reduced  Shuttle  budget  by 
$40  million  to  fund  Mars  initiative. 

•  NASA  reduced  Shuttle  $6.9  million  per  rescission  re- 
quirement. 

Fiscal  Year  2002 

•  Congress  reduced  Shuttle  budget  $50  million  to  reflect 
cancellation  of  electric  Auxiliary  Power  Unit  and  added 
$20  million  for  Shuttle  upgrades  and  $25  million  for 
Vehicle  Assembly  Building  repairs. 

•  NASA  transferred  $7. ft  million  to  fund  Headquarters  re- 
quirements and  cut  $1.2  million  per  rescission  require- 
ment. 

i  Source:  Marcia  Smith.  Congressional  Research  Service, 
Presentation  at  CAIB  Public  Hearing.  June  12.  200.^| 


not  attempt  to  exert  bureaucratic  control  over  a  complex 
organization,  but  rather  set  strategic  directions  and  provide 
operating  units  with  the  authority  and  resources  needed  to 
pursue  those  directions.  Another  Deming  principle  was  that 
checks  and  balances  in  an  organization  were  unnecessary 
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and  sometimes  counteiproductive,  and  those  carrying  out 
tiie  work  should  bear  primary  responsibility  for  its  quality. 
It  is  arguable  whether  these  business  principles  can  readily 
be  applied  to  a  government  agency  operating  under  civil 
service  rules  and  in  a  politicized  environment.  Nevertheless. 
Goldin  sought  to  implement  them  throughout  his  tenure.-" 

Goidin  made  many  positive  changes  in  his  decade  at  NASA. 
By  bringing  Russia  into  the  Space  Station  partnership  in 
1993,  Goldin  developed  a  new  post-Cold  War  rationale 
for  the  agency  while  managing  to  save  a  program  that  was 
politically  faltering.  The  International  Space  Station  became 
NASA's  premier  program,  with  the  Shuttle  serving  in  a  sup- 
porting role.  Goldin  was  also  instrumental  in  gaining  accep- 
tance of  the  "faster,  better,  cheaper"-**  approach  to  the  plan- 
ning of  robotic  missions  and  downsizing  "an  agency  that  was 
considered  bloated  and  bureaucratic  when  he  took  it  over."-'' 

Goldin  described  himself  as  "sharp-edged"  and  could  often 
be  blunt.  He  rejected  the  criticism  that  he  was  sacrificing 
safety  in  the  name  of  efficiency.  In  1994  he  told  an  audience 
at  the  Jet  Propulsion  Laboratory,  "When  I  ask  for  the  budget 
to  be  cut,  I'm  told  it's  going  to  impact  safety  on  the  Space 
Shuttle  ..,1  think  that's  a  bunch  of  crap."*" 

One  of  Goldin's  high-priority  objectives  was  to  decrease 
involvement  of  the  NASA  engineering  workforce  with  the 


Space  Shuttle  Program  and  thereby  free  up  those  skills  for 
finishing  the  space  station  and  beginning  work  on  his  pre- 
fened  objective-human  exploration  of  Mars.  Such  a  shift 
would  return  NASA  to  its  exploratory  mission.  He  was  often 
at  odds  with  those  who  continued  to  focus  on  the  centrality 
of  the  Shuttle  to  NASA's  future. 

Initial  Shuttle  Workforce  Reductions 

With  NASA  leadership  choosing  to  maintain  existing  pro- 
grams within  a  no-growth  budget,  Goldin's  "faster,  better, 
cheaper"  motto  became  the  agency's  slogan  of  the  1990s.*' 
NASA  leaders,  however,  had  little  maneuvering  room  in 
which  to  achieve  efficiency  gains.  Attempts  by  NASA 
Headquarters  to  shift  functions  or  to  close  one  of  the  three 
human  space  flight  centers  were  met  with  strong  resistance 
from  the  Centers  themselves,  the  aerospace  firms  they  used 
as  contractors,  and  the  congressional  delegations  of  the 
states  in  which  the  Centers  were  located.  This  alliance  re- 
.sembles  the  classic  "iron  triangle"  of  bureaucratic  politics, 
a  conservative  coalition  of  bureaucrats,  interest  groups,  and 
congressional  subcommittees  working  together  to  promote 
their  common  interests. '- 

With  Center  infrastructure  off-limits,  this  left  the  Space 
Shuttle  budget  as  an  obvious  target  for  cuts.  Because  the 
Shuttle  required  a  large  "standing  army"  of  workers  to 
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Figure  5.4-7.  Space  Shuttle  Program  workforce.  [Source:  NASA  Office  of  Space  Flight] 

*  Because  Johnson  Space  Center  manages  the  Space  Flight  Operations  Contract,  all  United  Space  Alliance  employees  are  counted  as 

worfe/ng  for  Johnson. 
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keep  it  flying,  reducing  the  size  of  the  Shuttle  wori<force 
became  the  primary  means  by  which  top  leaders  lowered  the 
Shuttle's  operating  costs.  These  personnel  reduction  efforts 
started  early  in  the  decade  and  continued  through  most  of 
the  1990s.  They  created  substantial  uncertainty  and  tension 
within  the  Shuttle  workforce,  as  well  as  the  transitional  diffi- 
culties inherent  in  any  large-scale  workforce  reassignment. 

In  early  1991,  even  before  Goldin  assumed  office  and  less 
than  three  years  after  the  Shuttle  had  returned  to  flight  after 
the  Challenger  accident.  NASA  announced  a  goal  of  saving 
three  to  five  percent  per  year  in  the  Shuttle  budget  over  five 
years.  This  move  was  in  reaction  to  a  perception  that  the 
agency  had  overreacted  to  the  Rogers  Commission  recom- 
mendations -  for  example,  the  notion  that  the  many  layers  of 
safety  inspections  involved  in  preparing  a  Shuttle  for  flight 
had  created  a  bloated  and  costly  safety  program. 

From  1991  to  1994,  NASA  was  able  to  cut  Shuttle  operating 
costs  by  21  percent.  Contractor  personnel  working  on  the 
Shuttle  declined  from  28.394  to  22.387  in  these  three  years, 
and  NASA  Shuttle  staff  decreased  from  4.031  to  2,959." 
Figure  5.4-1  shows  the  changes  in  Space  Shuttle  workforce 
over  the  past  decade.  A  1994  National  Academy  of  Public 
.Administration  review  found  that  these  cuts  were  achieved 
primarily  through  "operational  and  organizational  efficien- 
cies and  consolidations,  with  resultant  reductions  in  staffing 
levels  and  other  actions  which  do  not  significantly  impact 
basic  program  content  or  capabilities."*^ 

NASA  considered  additional  staff  cuts  in  late  1994  and  early 
1995  as  a  way  of  further  reducing  the  Space  Shuttle  Program 
budget.  In  early  1995.  as  the  national  leadership  focused  its 
attention  on  balancing  the  federal  budget,  the  projected 
five-year  Shuttle  budget  requirements  exceeded  by  $2.5  bil- 
lion the  budget  that  was  likely  to  be  approved  by  the  White 
House  Office  of  Management  and  Budget.'^  Despite  its  al- 
ready significant  progress  in  reducing  costs,  NASA  had  to 
make  further  workforce  cuts. 

Anticipating  this  impending  need,  a  1994-1995  NASA 
"Functional  Workforce  Review"  concluded  that  removing 
an  additional  5,900  people  from  the  NASA  and  contractor 
Shuttle  workforce  -just  under  1 3  percent  of  the  total  -  could 
be  done  without  compromising  safety."'  These  personnel 
cuts  were  made  in  Fiscal  Years  1996  and  1997.  By  the  end 
of  1997,  the  NASA  Shuttle  civilian  workforce  numbered 
2, 1 95,  and  the  contractor  workforce  1 7,28 1 . 

Shifting  Shuttle  Management  Arrangements 

Workforce  reductions  were  not  the  only  modifications  to  the 
Shuttle  Program  in  the  middle  of  the  decade.  In  keeping  with 
Goldin's  philosophy  that  Headquarters  should  concern  itself 
primarily  with  strategic  issues,  in  February  1996  Johnson 
Space  Center  was  designated  as  "lead  center"  for  the  Space 
Shuttle  Program,  a  role  it  held  prior  to  the  Challenger  ac- 
cident. This  shift  was  part  of  a  general  move  of  all  program 
management  responsibilities  from  NASA  Headquarters  to 
the  agency's  field  centers.  Among  other  things,  this  change 
meant  that  Johnson  Space  Center  managers  would  have  au- 
thority over  the  funding  and  management  of  Shuttle  activi- 


ties at  the  Marshall  and  Kennedy  Centers.  Johnson  and  Mar- 
shall had  been  rivals  since  the  days  of  Apollo,  and  long-term 
Marshall  employees  and  managers  did  not  easily  accept  the 
return  of  Johnson  to  this  lead  role. 

The  shift  of  Space  Shuttle  Program  management  to  Johnson 
was  worrisome  to  some.  The  head  of  the  Space  Shuttle  Pro- 
gram at  NASA  Headquarters,  Bryan  O'Connor,  argued  that 
transfer  of  the  management  function  to  the  Johnson  Space 
Center  would  return  the  Shuttle  Program  management  to  the 
flawed  structure  that  was  in  place  before  the  Challenger  ac- 
cident. "It  is  a  safety  issue."  he  said,  "we  ran  it  that  way  (with 
program  management  at  Headquarters,  as  recommended  by 
the  Rogers  Commission |  for  10  years  without  a  mishap  and 
I  didn't  see  any  reason  why  we  should  go  back  to  the  way 
we  operated  in  the  pre-Challenger  days."'"  Goldin  gave 
O'Connor  several  opportunities  to  present  his  arguments 
against  a  transfer  of  management  responsibility,  but  ulti- 
mately decided  to  proceed.  O'Connor  felt  he  had  no  choice 
but  to  resign. '**  (O'Connor  returned  to  NASA  in  2002  as  As- 
sociate Administrator  for  Safety  and  Mission  Assurance.) 

In  January  1996.  Goldin  appointed  as  John.son's  director  his 
close  advisor.  George  W.S.  Abbey.  Abbey,  a  space  program 
veteran,  was  a  firm  believer  in  the  values  of  the  original  hu- 
man space  flight  culture,  and  as  he  assumed  the  directorship, 
he  set  about  recreating  as  many  of  the  positive  features  of 
that  culture  as  possible.  For  example,  he  and  Goldin  initiat- 
ed, as  a  way  for  young  engineers  to  get  hands-on  experience, 
an  in-house  X-38  development  program  as  a  prototype  for 
a  space  station  crew  rescue  vehicle.  Abbey  was  a  powerful 
leader,  who  through  the  rest  of  the  decade  exerted  substan- 
tial control  over  all  aspects  of  Johnson  Space  Center  opera- 
tions, including  the  Space  Shuttle  Program. 

Space  Flight  Operations  Contract 

By  the  middle  of  the  decade,  spurred  on  by  Vice  President  Al 
Gore's  "reinventing  government"  initiative,  the  goal  of  bal- 
ancing the  federal  budget,  and  the  views  of  a  Republican-led 
House  of  Representatives,  managers  throughout  the  govern- 
ment sought  new  ways  of  making  public  sector  programs 
more  efficient  and  less  costly.  One  method  considered  was 
transferring  significant  government  operations  and  respon- 
sibilities to  the  private  sector,  or  "privatization."  NASA  led 
the  way  toward  privatization,  serving  as  an  example  to  other 
government  agencies. 

In  keeping  with  his  philo.sophy  that  NASA  should  focus  on 
its  research-and-development  role,  Goldin  wanted  to  remove 
NASA  employees  from  the  repetitive  operations  of  vari- 
ous systems,  including  the  Space  Shuttle.  Giving  primary 
responsibility  for  Space  Shuttle  operations  to  the  private 
sector  was  therefore  consistent  with  White  House  and 
congressional  priorities  and  attractive  to  Goldin  on  its  own 
terms.  Beginning  in  1994.  NASA  considered  the  feasibility 
of  consolidating  many  of  the  numerous  Shuttle  operations 
contracts  under  a  single  prime  contractor.  At  that  time,  the 
Space  Shuttle  Program  was  managing  86  separate  contracts 
held  by  56  different  firms.  Top  NASA  managers  thought  that 
consolidating  these  contracts  could  reduce  the  amount  of 
redundant  overhead,  both  for  N.ASA  and  for  the  contractors 
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themselves.  They  also  wanted  to  explore  whether  there  were 
functions  being  canied  out  by  NASA  that  C(Hild  be  more  ef- 
fectively and  inexpensively  catried  out  by  the  private  sector. 

An  advisory  committee  headed  by  early  space  flight  veteran 
Christopher  Kraft  recommended  such  a  step  in  its  March 
1995  report,  which  became  known  as  the  "Kraft  Report.""' 
(The  report  characterized  the  Space  Shuttle  in  a  way  that  the 
Board  judges  to  be  at  odds  with  the  realities  of  the  Shuttle 
Program). 

The  report  made  the  following  findings  and  recommenda- 
tions: 

•  "The  Shuttle  has  become  a  mature  and  reliable  system 
...  about  as  safe  as  today's  technology  will  provide." 

•  "Given  the  maturity  of  the  vehicle,  a  change  to  a  new 
mode  of  management  with  considerably  less  NASA 
oversight  is  possible  at  this  time." 

•  "Many  inefficiencies  and  difficulties  in  the  current 
Shuttle  Program  can  be  attributed  to  the  diffuse  and 
fragmented  NASA  and  contractor  structure.  Numerous 
contractors  exist  supporting  various  program  elements, 
resuUing  in  ambiguous  lines  of  communication  and  dif- 
fused responsibilities." 

•  NASA  should  "consolidate  operations  under  a  single- 
business  entity." 

•  "The  program  remains  in  a  quasi-development  mode 
and  yearly  costs  remain  higher  than  required,"  and 
NASA  should  "freeze  the  current  vehicle  configuration, 
minimizing  future  modifications,  with  such  modifica- 
tions delivered  in  block  updates.  Future  block  updates 
should  implement  modifications  required  to  make  the 
vehicle  more  re-usable  and  operational." 

•  NASA  should  "restrticture  and  reduce  the  overall 
Safety,  Reliability,  and  Quality  A.ssurance  elements 
-  without  reducing  safety."* 

When  he  released  his  committee's  report,  Kraft  said  that  "if 
NASA  wants  to  make  more  substantive  gains  in  terms  of  ef- 
ficiency, cost  savings  and  better  service  to  its  customers,  we 
think  it"s  imperative  they  act  on  these  recommendations  ... 
,^nd  we  believe  that  these  savings  are  real,  achievable,  and 
can  be  accomplished  with  no  impact  to  the  safe  and  success- 
ful operation  of  the  Shuttle  system."'" 

Although  the  Kraft  Report  stressed  that  the  dramatic  changes 
it  recommended  could  be  made  without  compromising  safe- 
ty, there  was  considerable  dissent  about  this  claim.  NASA's 
.Aerospace  Safety  Advisory  Panel  -  independent,  but  often 
not  very  influential  -  was  particularly  critical,  in  May  199.5. 
the  Panel  noted  that  "the  assumption  [in  the  Kraft  Report] 
that  the  Space  Shuttle  systems  are  now  'mature'  smacks  of 
a  complacency  which  may  lead  to  serious  mishaps.  The  fact 
is  that  the  Space  Shuttle  may  never  be  mature  enough  to  to- 
tally freeze  the  design."  The  Panel  also  noted  that  "the  report 
dismisses  the  concerns  of  many  credible  sources  by  labeling 
honest  reservations  and  the  people  who  have  made  them  as 
being  partners  in  an  unneeded  'safety  shield'  conspiracy. 
Since  only  one  more  accident  would  kill  the  program  and 
destroy  far  more  than  the  spacecraft,  it  is  extremely  callous" 
to  make  such  an  accusation."*- 


The  notion  that  NASA  would  further  reduce  the  number  of 
civil  servants  working  on  the  Shuttle  Program  prompted 
senior  Kennedy  Space  Center  engineer  Jose  Garcia  to  send 
to  President  Bill  Clinton  on  August  25,  1995,  a  letter  that 
stated,  "The  biggest  threat  to  the  safety  of  the  crew  since 
the  Challenger  disaster  is  presently  underway  at  NASA." 
Garcia's  particular  concern  was  NASA's  "efforts  to  delete 
the  "checks  and  balances'  system  of  processing  Shuttles  as  a 
way  of  saving  money  ...  Historically  NASA  has  employed 
two  engineering  teams  at  KSC,  one  contractor  and  one  gov- 
ernment, to  cross  check  each  other  and  prevent  catastrophic 
errors  ...  although  this  technique  is  expensive,  it  is  effec- 
tive, and  it  is  the  single  most  important  factor  that  sets  the 
Shuttle's  success  above  that  of  any  other  launch  vehicle  ... 
Anyone  who  doesn't  have  a  hidden  agenda  or  fear  of  losing 
his  job  would  admit  that  you  can't  delete  NASA's  checks 
and  balances  system  of  Shuttle  processing  without  affecting 
the  safety  of  the  Shuttle  and  crew.""'' 

NASA  leaders  accepted  the  advice  of  the  Kraft  Report  and 
in  August  1995  solicited  industry  bids  for  the  assignment  of 
Shuttle  prime  contractor  In  response,  Lockheed  Martin  and 
Rockwell,  the  two  major  Space  Shuttle  operations  contrac- 
tors, formed  a  limited  liability  corporation,  with  each  firm  a 
50  percent  owner,  to  compete  for  what  was  called  the  Space 
Flight  Operations  Contract.  The  new  corporation  would  be 
known  as  United  Space  Alliance. 

In  November  1995,  NASA  awarded  the  operations  contract 
to  United  Space  Alliance  on  a  sole  source  basis.  (When 
Boeing  bought  Rockwell's  aerospace  group  in  December 
1996,  it  also  took  over  Rockwell's  50  percent  ownership  of 
United  Space  Alliance.)  The  company  was  responsible  for 
61  percent  of  the  Shuttle  operations  contracts.  Some  in  Con- 
gress were  skeptical  that  safety  could  be  maintained  under 
the  new  arrangement,  which  transferred  significant  NASA 
responsibilities  to  the  private  sector.  Despite  these  concerns. 
Congress  ultimately  accepted  the  reasoning  behind  the 
contract.^  NASA  then  spent  much  of  1996  negotiating  the 
contract's  terms  and  conditions  with  United  Space  Alliance. 

The  Space  Flight  Operations  Contract  was  designed  to  reward 
United  Space  Alliance  for  performance  successes  and  penal- 
ize its  performance  failures.  Before  being  eligible  for  any 
performance  fees.  United  Space  Alliance  would  have  to  meet 
a  series  of  safety  "gates,"  which  were  intended  to  ensure  that 
safety  remained  the  top  priority  in  Shuttle  operations.  The 
contract  also  rewarded  any  cost  reductions  that  United  Space 
Alliance  was  able  to  achieve,  with  N.ASA  taking  65  percent 
of  any  savings  and  United  Space  Alliance  35  percent.^^ 

NASA  and  United  Space  Alliance  formally  signed  the 
Space  Flight  Operations  Contract  on  October  I,  1996.  ini- 
tially, only  the  major  Lockheed  Martin  and  Rockwell  Shuttle 
contracts  and  a  smaller  Allied  Signal  L'nisys  contract  were 
transferred  to  United  Space  Alliance.  The  initial  contractual 
period  was  six  years,  from  October  1996  to  September  2002. 
NASA  exerci.sed  an  option  for  a  two-year  extension  in  2002. 
and  another  two-year  option  exists.  The  total  value  of  the 
contract  through  the  current  extension  is  estimated  at  $12.8 
billion.  United  Space  Alliance  currently  has  approximately 
10,000  employees. 
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Space  Flight  Operations  Contract 

The  Space  Flight  Operations  Contract  has  two  major  areas 
of  innovation: 

•  It  replaced  the  previous  "cost-plus"  contracts  ( in  which  a 
firm  was  paid  for  the  costs  of  its  activity  plus  a  negotiat- 
ed profit)  w  ith  a  complex  contract  structure  that  included 
performance-based  and  cost  reduction  incentives.  Per- 
formance measures  include  safety,  launch  readiness, 
on-time  launch.  Solid  Rocket  Booster  recovery,  proper 
orbital  insertion,  and  successful  landing. 

•  It  ea\e  additional  responsibilities  for  Shuttle  operation, 
including  safety  and  other  inspections  and  integration 
of  the  various  elements  of  the  Shuttle  system,  to  United 
Space  Alliance.  Many  of  those  responsibilities  were  pre- 
viously within  the  purview  of  NASA  employees. 

Under  the  Space  Flight  Operations  Contract.  United  Space 
Alliance  had  overall  responsibility  for  processing  selected 
Shuttle  hardware,  including; 

•  Inspecting  and  modifying  the  Orbiters 

•  Installing  the  Space  Shuttle  Main  Engines  on  the  Orbit- 
ers 

•  Assembling  the  sections  that  make  up  the  Solid  Rocket 
Boosters 

•  Attaching  the  External  Tank  to  the  Solid  Rocket  Boost- 
ers, and  then  the  Orbiter  to  the  External  Tank 

•  Recovering  expended  Solid  Rocket  boosters 

In  addition  to  processing  Shuttle  hardware,  L'nited  Space 
Alliance  is  responsible  for  mission  design  and  planning, 
a.stronaut  and  flight  controller  training,  design  and  integration 
of  flight  software,  payload  integration,  flight  operations, 
launch  and  recovery  operations,  vehicle-sustaining 
engineering,  flight  crew  equipment  processing,  and  operation 
and  maintenance  of  Shuttle-specific  facilities  such  as 
the  Vehicle  Assembly  Building,  the  Orbiter  Processing 
Facility,  and  the  launch  pads.  United  Space  Alliance  also 
provides  spare  parts  for  the  Orbiters,  maintains  Shuttle 
flight  simulators,  and  provides  tools  and  supplies,  including 
consumables  such  as  food,  for  Shuttle  missions. 

Under  the  Space  Flight  Operations  Contract.  NASA  has  the 
following  responsibilities  and  roles: 

•  Maintaining  ownership  of  the  Shuttles  and  all  other  as- 
sets of  the  Shuttle  program 

•  Providing  to  United  Space  Alliance  the  Space  Shuttle 
Main  Engines,  the  External  Tanks,  and  the  Redesigned 
Solid  Rocket  Motor  segments  for  assembly  into  the 
Solid  Rocket  Boosters 

•  Managing  the  overall  process  of  ensuring  Shuttle  safety 

•  Developing  requirements  for  major  upgrades  to  all  as- 
sets 

•  Participating  in  the  planning  vi  Shuttle  missions,  the 
directing  of  launches,  and  the  execution  of  flights 

•  Performing  surveillance  and  audits  and  obtaining  tech- 
nical insight  into  contractor  activities 

•  Deciding  if  and  when  to  "commit  to  flight"  for  each  mis- 
sion* 


The  contract  provided  for  additional  consolidation  and  then 
privatization,  when  all  remaining  Shuttle  operations  would 
be  transferred  from  NASA.  Phase  2,  scheduled  tor  1998- 
2000,  called  for  the  transfer  of  Johnson  Space  Center-man- 
aged flight  software  and  flight  crew  equipment  contracts 
and  the  Marshall  Space  Center-managed  contracts  for  the 
External  Tank,  Space  Shuttle  Main  Engine,  Reusable  Solid 
Rocket  Motor,  and  Solid  Rocket  Booster. 

However,  Marshall  and  its  contractors,  with  the  concurrence 
of  the  Space  Shuttle  Program  Office  at  Johnson  Space  Cen- 
ter, successfully  resisted  the  transfer  of  its  contracts.  There- 
fore, the  Space  Elight  Operations  Contract's  initial  efficiency 
and  integrated  management  goals  have  not  been  achieved. 

The  major  annual  savings  resulting  from  the  Space  Flight 
Operations  Contract,  which  in  1996  were  touted  to  be  some 
$500  million  to  $1  billion  per  year  by  the  early  2000s, 
have  not  materialized.  These  projections  assumed  that  by 
2002.  NASA  would  have  put  all  Shuttle  contracts  under 
the  auspices  of  United  Space  Alliance,  and  would  be  mov- 
ing toward  Shuttle  privatization.  Although  the  Space  Flight 
Operations  Contract  has  not  been  as  successful  in  achiev- 
ing cost  efficiencies  as  its  proponents  hoped,  it  has  reduced 
some  Shuttle  operating  costs  and  other  expenses.  By  one 
estimate,  in  its  first  six  years  the  contract  has  saved  NASA  a 
total  of  more  than  $1  billion.'*'' 

Privatizing  the  Space  Shuttle 

To  its  proponents,  the  Space  Flight  Operations  Contract  was 
only  a  beginning.  In  October  1997.  United  Space  Alliance 
submitted  to  the  Space  Shuttle  Program  Office  a  contrac- 
tually required  plan  for  privatizing  the  Shuttle,  which  the 
program  did  not  accept.  But  the  notion  of  Shuttle  privatiza- 
tion lingered  at  NASA  Hcadquaiters  and  in  Congress,  where 
some  members  advocated  a  greater  private  sector  role  in  the 
space  program.  Congress  passed  the  Commercial  Space  Act 
of  1998.  which  directed  the  NASA  Administrator  to  "plan  for 
the  eventual  privatization  of  the  Space  Shuttle  Program. ■■^'* 

By  August  2001.  NASA  Headquailers  prepared  for  White 
House  consideration  a  "Privatization  White  Paper"  that  called 
for  transferring  all  Shuttle  hardware,  pilot  and  commander 
astronauts,  and  launch  and  operations  teams  to  a  private  op- 
erator. ■*"  In  September  2001 .  Space  Shuttle  Program  Manager 
Ron  Dittemore  released  his  report  on  a  "Concept  of  Priva- 
tization of  the  Space  Shuttle  Program.'"'"  which  argued  that 
for  the  Space  Shuttle  "to  remain  safe  and  viable,  it  is  neces- 
sary to  merge  the  required  NASA  and  contractor  skill  bases" 
into  a  single  private  organization  that  would  manage  human 
space  flight.  This  perspective  reflected  Dittemore  "s  belief  that 
the  split  of  responsibilities  between  NASA  and  United  Space 
Alliance  was  not  optimal,  and  that  it  was  inilikely  that  NASA 
would  ever  recapture  the  Shuttle  responsibilities  that  were 
transferred  in  the  Space  Flight  Operations  Contract. 

Dittemore's  plan  recommended  transferring  700  to  900 
NASA  employees  to  the  private  organization,  including: 

•  Astronauts,  including  the  flight  crew  members  who  op- 
erate the  Shuttle 
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•  Program  and  project  management,  including  Space 
Shuttle  Main  Engine,  External  lank.  Redesigned  Solid 
Rocket  Booster,  and  Extravehicular  Activity 

•  Mission  operations,  including  flight  directors  and  flight 
controllers 

•  Ground  operations  and  processing,  including  launch 
director,  process  engineering,  and  flow  management 

•  Responsibility  for  safety  and  mission  assurance 

After  such  a  shift  occurred,  according  to  the  Dittemore  plan, 
"the  primary  role  for  NASA  in  Space  Shuttle  operations  ... 
will  be  to  provide  an  SMA  [Safety  and  Mission  Assurance] 
independent  assessment  ...  utilizing  audit  and  surveillance 
techniques."^' 

With  a  change  in  NASA  Administrators  at  the  end  of  2001 
and  the  new  Bush  Administration's  emphasis  on  "competitive 
sourcing"  of  government  operations,  the  notion  of  wholesale 
privatization  of  the  Space  Shuttle  was  replaced  with  an  ex- 
amination of  the  feasibility  of  both  public-  and  private-sector 
Program  management.  This  competitive  sourcing  was  under 
examination  at  the  time  of  the  Coliiiiihia  accident. 

Workforfce  TransformaHon  and  the  End  of 
Downsizing 

Workforce  reductions  instituted  by  Administrator  Goldin  as 
he  attempted  to  redefine  the  agency's  mission  and  its  overall 
organization  also  added  to  the  turbulence  of  his  reign.  In  the 
1990s,  the  overall  NASA  workforce  was  reduced  by  25  per- 
cent through  normal  attrition,  early  retirements,  and  buyouts 
-  cash  bonuses  for  leaving  NASA  employment.  NASA  op- 
erated under  a  hiring  freeze  for  most  of  the  decade,  making 
it  difficult  to  bring  in  new  or  younger  people.  Figure  5.4-2 
shows  the  downsizing  of  the  overall  NASA  workforce  dur- 
ing this  period  as  well  as  the  associated  shrinkage  in  NASA's 
technical  workforce. 

NASA  Headquarters  was  particularly  affected  by  workforce 
reductions.  More  than  half  its  employees  left  or  were  trans- 
ferred in  parallel  with  the  1996  transfer  of  program  manage- 
ment responsibilities  back  to  the  NASA  centers.  The  Space 
Shuttle  Program  bore  more  than  its  share  of  Headquarters 
personnel  cuts.  Headquarters  civil  service  staff  working  on 
the  Space  Shuttle  Program  went  from  120  in  1993  to  12  in 
2003. 

While  the  overall  workforce  at  the  NASA  Centers  involved 
in  human  space  flight  was  not  as  radically  reduced,  the 
combination  of  the  general  workforce  reduction  and  the 
intrt)duction  of  the  Space  Flight  Operations  Contract  sig- 
nificantly impacted  the  Centers'  Space  Shuttle  Program  civil 
service  staff.  Johnson  Space  Center  went  from  1 ,330  in  1993 
to  738  in  2002;  Marshall  Space  Flight  Center,  from  874  to 
337;  and  Kennedy  Space  Center  from  1.373  to  615.  Ken- 
nedy Director  Roy  Bridges  argued  that  personnel  cuts  were 
too  deep,  and  threatened  to  resign  unless  the  downsizing  of 
his  civil  service  workforce,  particularly  those  involved  with 
safety  issues,  was  reversed.''" 

By  the  end  of  the  decade.  NASA  realized  that  staff  reduc- 
tions had  gone  too  far.  By  early  2000.  internal  and  external 
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Figure  5.4-2.  Downsizing  of  the  overall  NASA  workforce  and  ihe 
NASA  technical  workforce. 

Studies  convinced  NASA  leaders  that  the  workforce  needed 
to  be  revitalized.  These  studies  noted  that  "five  years  of 
buyouts  and  downsizing  have  led  to  serious  skill  imbal- 
ances and  an  overtaxed  core  workforce.  As  more  employees 
have  departed,  the  workload  and  stress  |on  those]  remain- 
ing have  increased,  with  a  corresponding  increase  in  the 
potential  for  impacts  to  operational  capacity  and  safety."^' 
NASA  announced  that  NASA  workforce  downsizing  would 
stop  short  of  the  1 7.500  target,  and  that  its  human  space  flight 
centers  would  immediately  hire  several  hundred  workers. 

5.5    When  to  Replace  the  Space  Shuhle? 

In  addition  to  budget  pressures,  workforce  reductions,  man- 
agement changes,  and  the  transfer  of  government  functions 
to  the  private  sector,  the  Space  Shuttle  Program  was  beset 
during  the  past  decade  by  uncertainty  about  when  the  Shuttle 
might  be  replaced.  National  policy  has  vacillated  between 
treating  the  Shuttle  as  a  "going  out  of  business"  program 
and  anticipating  two  or  more  decades  of  Shuttle  use.  As  a 
result,  limited  and  inconsistent  investments  have  been  made 
in  Shuttle  upgrades  and  in  revitalizing  the  infrastructure  to 
support  the  continued  use  of  the  Shuttle. 

Even  before  the  1986  ChalU'iii>er  accident,  when  and  how 
to  replace  the  Space  Shuttle  with  a  second  generation  reus- 
able launch  vehicle  was  a  topic  of  discussion  among  space 
policy  leaders.  In  January  1986,  the  congressionally  char- 
tered National  Commission  on  Space  expressed  the  need 
for  a  Shuttle  replacement,  suggesting  that  "the  Shuttle 
fleet  will  become  obsolescent  by  the  turn  of  the  century.'"'"' 
Shortly  after  the  Clialk'iii^er  accident  (but  not  as  a  reaction 
to  it).  President  Reagan  announced  his  approval  of  "the  new 
Orient  Express"  (see  Figure  5.5-1).  This  reusable  launch 
vehicle,  later  known  as  the  National  Aerospace  Plane, 
"could,  by  the  end  of  the  decade,  take  off  from  Dulles  Air- 
port, accelerate  up  to  25  times  the  speed  of  sound  attaining 
low-Earth  orbit,  or  fly  to  Tokyo  within  two  hours. '"'^  This 
goal  proved  too  ambitious,  particularly  u  ithout  substantia! 
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funding.  In  1992.  after  a  $1.7  billion  government  invest- 
ment, the  National  Aerospace  Plane  project  was  cancelled. 

This  pattern  -  optimistic  pronouncements  about  a  revolu- 
tionary Shuttle  replacement  followed  by  insufficient  gov- 
ernment in\estment.  and  then  program  cancellation  due  to 
technical  difhculties  -  was  repeated  again  in  the  1990s. 


Figure  5.5-1.  A  7986  artist's  conception  of  the  National  Aerospace 
Plane  on  o  mission  fo  the  Space  Station. 


In    1994.   NASA  listed  alternatives   for  access  to  space 
through  2030. 

•  Upgrade  the  Space  Shuttle  to  enable  flights  through 
203^0 

•  Develop  a  new  expendable  launcher 

•  Replace  the  Space  Shuttle  with  a  "leapfrog""  next-gen- 
eration advanced  technology  system  that  would  achieve 
order-of-magnitude  improvements  in  the  cost  effective- 
ness of  space  transportation.""' 


Figure  5.5-2.  The  VeniureStar  was  intended  to  replace  the  Space 
Shuttle  based  on  technology  developed  for  the  X-33. 


Reflecting  its  leadership's  preference  for  bold  initiatives, 
NASA  chose  the  third  alternative.  With  White  House  sup-., 
port,''"  NASA  began  the  X-33  project  in  1996  as  a  joint  effort 
with  Lockheed  Martin.  NASA  also  initiated  the  less  ambi- 
tious X-34  project  with  Orbital  Sciences  Corporation.  At  the 
time,  the  future  of  commercial  space  launches  was  bright, 
and  political  sentiment  in  the  White  House  and  Congress 
encouraged  an  increasing  reliance  on  private-sector  solu- 
tions for  limiting  government  expenditures.  In  this  context, 
these  unprecedented  joint  projects  appeared  less  risky  than 
they  actually  were.  The  hope  was  that  NASA  could  replace 
the  Shuttle  through  private  investments,  without  significant 
government  spending. 

Both  the  X-33  and  X-34  incorporated  new  technologies. 
The  X-33  was  to  demonstrate  the  feasibility  of  an  aerospike 
engine,  new  Thermal  Protection  Systems,  and  composite 
rather  than  metal  propcllant  tanks.  These  radically  new  tech- 
nologies were  in  turn  to  become  the  basis  for  a  new  orbital 
vehicle  called  VentureStar"^"  that  could  replace  the  Space 
Shuttle  by  2006  (see  Figure  5.5-2).  The  X-33  and  X-34  ran 
into  technical  problems  and  never  flew.  In  2001 ,  after  spend- 
ing SI. 3  billion.  NASA  abandoned  both  projects. 

In  all  three  projects  -  National  Aerospace  Plane,  X-33,  and 
X-34  -  national  leaders  had  set  ambitious  goals  in  response 
to  NASA's  ambitious  proposals.  These  programs  relied  on 
the  invention  of  revolutionary  technology,  had  run  into 
major  technical  problems,  and  had  been  denied  the  funds 
needed  to  overcome  these  problems  -  assuming  they  could 
be  solved.  NASA  had  spent  nearly  15  years  and  several 
billion  dollars,  and  yet  had  made  no  meaningful  progress 
toward  a  Space  Shuttle  replacement. 

In  2000,  as  the  agency  ran  into  increasing  problems  with 
the  X-33,  NASA  initiated  the  Space  Launch  Initiative,  a 
$4.5  billion  multi-year  effort  to  develop  new  space  launch 
technologies.  By  2002,  after  spending  nearly  $800  million, 
NASA  again  changed  course.  The  Space  Launch  Initiative 
failed  to  find  technologies  that  could  revolutionize  space 
launch,  forcing  NASA  to  shift  its  focus  to  an  Orbital  Space 
Plane,  developed  with  existing  technology,  that  would  com- 
plement the  Shuttle  by  carrying  crew,  but  not  cargo,  to  and 
from  orbit.  Under  a  new  Integrated  Space  Transportation 
Plan,  the  Shuttle  might  continue  to  fly  until  2020  or  beyond. 
(See  Section  5.6  for  a  discussion  of  this  plan.) 

As  a  result  of  the  haphazard  policy  process  that  created  these 
still-bom  developmental  programs,  the  uncertainty  over 
Shuttle  replacement  persisted.  Between  1986  and  2002,  the 
planned  replacement  date  for  the  Space  Shuttle  was  consis- 
tent only  in  its  inconsistency:  it  changed  from  2002  to  2006 
to  201 2,  and  before  the  Coliimhia  accident,  to  2020  or  later. 

Safety  Concerns  and  Upgrading  the  Space  Shuttle 

This  shifting  date  for  Shuttle  replacement  has  severely  com- 
plicated decisions  on  how  to  invest  in  Shuttle  Program  up- 
grades. More  often  than  not.  investments  in  upgrades  were 
delayed  or  deferred  on  the  assumption  they  would  be  a  waste 
of  money  if  the  Shuttle  were  to  be  retired  in  the  near  future 
(see  Figure  5.5-3). 
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Past  Reports  Reviewed 


During  the  course  of  the  investigation,  more  than  50  past  reports  regarding  NASA  and  the  Space  Shuttle  Program  were  reviewed.  The 
principal  purpose  of  these  reviews  what  factors  those  reports  examined,  what  findings  were  made,  and  what  response,  if  any.  NASA  may 
have  made  to  the  findings.  Board  members  then  used  these  findings  and  responses  as  a  benchmark  during  their  investigation  to   compare 
to  NASA's  current  programs.   In  addition  to  an  extensive  3()()-page  examination  of  every  Aerospace  Safely  Advisory  Panel  report    (see 
Appendix  D.  18),  the  reports  listed  on  the  accompanying  chart  were  examined  for  specific  factors  related  to  the  investigation.  A  complete 
listing  of  those  past  reports'  findings,  is  contained  in  Appendix  D.  1 S. 
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Rogers  Commission  Report  -  1986 

• 

• 

• 

• 

• 

• 

STS-29R  Preiaunch  Assessment  -1989 

"Augustine  Report"  -  1990 

• 

• 

• 

• 

Pate-Cornell  Report  -  1990 

• 

"Aldridge  Report"  -  1992 

GAO:    NASA  Infrastructure  -  1996 

• 

• 

GAO:    NASA  Workforce  Reductions  -  1996 

• 

• 

Super  Light  Weight  Tank  Independent 
Assessment  -  1997 

• 

• 

Process  Readiness  Review  -  1998 

• 

• 

• 

S&MA  Ground  Operations  Report  -  1998 

• 

GAO:    NASA  Management  Challenges 
-  1999 

• 

• 

• 

Independent  Assessment  JS-9047  -  1999 

• 

Independent  Assessment  JS-9059  -  1999 

• 

Independent  Assessment  JS-9078  -  1999 

• 

• 

Independent  Assessment  JS-9083  -  1999 

• 

S&MA  Ground  Operations  Report  -  1999 

• 

• 

Space  Shuttle  Independent  Assessment  Team 
-  1999 

• 

• 

• 

• 

• 

Space  Shuttle  Ground  Operations  Report 
-  1999 

• 

Space  Shuttle  Program  (SSP)  Annual  Report 
-  1999 

• 
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GAO;    Human  Capital  &  Safety  -  2000 

• 

Independent  Assessment  JS-0032  -  2000 

• 

Independent  Assessment  JS-0034  -  2000 

• 

Independent  Assessment  JS-0045  -  2000 

• 

IG  Audit  Report  00-039  -  2000 

• 

NASA  Independent  Assessment  Team  -  2000 

• 

• 

• 

• 

• 

Space  Shuttle  Program  Annual  Report  -  2000 

• 

• 

• 

• 

ASAP  Report  -  2001 

• 

• 

• 

• 

• 

• 

• 

GAO:    NASA  Critical  Areas  -  2001 

• 

GAO;    Space  Shuttle  Safety  -  2001 

• 

Independent  Assessment  JS-101 4  -  2001 

• 

• 

• 

• 

Independent  Assessment  JS-1024  -  2001 

• 

• 

• 

Independent  Assessment  KS-0003  -  2001 

• 

• 

• 

Independent  Assessment  KS-lOOl  -  2001 

9 

• 

Workforce  Survey-KSC  -  2001 

• 

Space  Shuttle  Program  Annual  Report  -  2001 

• 

SSP  Processina  Independent  Assessment 
-  2001 

• 

• 

• 

ASAP  Report  -  2002 

• 

• 

• 

• 

• 

GAO:    Lessons  Learned  Process  -  2002 

• 

Independent  Assessment  KS-1002  -  2002 

« 

Selected  NASA  Lessons  Learned  -  1992-2002 

• 

• 

• 

• 

• 

• 

NASA/Navy  Benchmarking  Exchange  -  2002 

• 

• 

• 

• 

• 

Space  Shuttle  Program  Annual  Report  -  2002 

• 

• 

• 

• 

ASAP  Leading  Indicators  -  2003 

• 

• 

• 

NASA  Quality  Management  System  -  2003 

• 

QAS  Tiger  Team  Report  -  2003 

• 

Shuttle  Business  Environment  -  2003 

• 
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Fiscal  Year 

Upgrades 

1994 

$454.5 

1995 

$247.2 

1996 

$224.5 

1997 

$215.9 

1998 

$206.7 

1999 

$175.2 

2000 

$239.1 

2001 

$289.3 

2002 

$379.5 

2003 

$3475 

Figure   5.5-3.    Shuffle    Upgrade   Budgets    (in   millions   of  dollars). 
(Source.  NASA) 


In  1995,  for  instance,  the  Kraft  Report  embraced  the  prin- 
ciple that  NASA  .should  "freeze  the  design'"  of  the  Shuttle 
and  defer  upgrades  due  to  the  vehicle's  "mature"  status 
and  the  n^ed  for  NASA  to  "concentrate  scarce  resources  on 
developing  potential  replacements  for  the  Shuttle."^*'  NASA 
subsequently  halted  a  number  of  planned  upgrades,  only 
to  reverse  course  a  year  later  to  "take  advantage  of  tech- 
nologies to  improve  Shuttle  safety  and  the  need  for  a  robust 
Space  Shuttle  to  assemble  the  ISS."''^ 

in  a  June  1999  letter  to  the  White  House,  NASA  Adminis- 
trator Daniel  Goldin  declared  that  the  nation  faced  a  "Space 
Launch  Crisis."  He  reported  on  a  NASA  review  of  Shuttle 
safety  that  indicated  the  budget  for  Shuttle  upgrades  in  Fiscal 
year  2000  was  "inadequate  to  accommodate  upgrades  neces- 
sary to  yield  significant  safety  improvements."'^'  After  two 
"clo.se  calls"  during  STS-93  in  July  1999  Goldin  also  char- 
tered a  Shuttle  Independent  Assessment  Team  (Si  AT)  chaired 
by  Harry  McDonald,  Director  of  NASA  Ames  Research  Cen- 
ter Among  the  team's  findings,  reported  in  March  2000:"' 

•  "Over  the  course  of  the  Shuttle  Program  ...  proces.ses, 
procedures  and  training  have  continuously  been  im- 
proved and  implemented  to  make  the  system  safer.  The 
SI  AT  has  a  major  concern  ...  that  this  critical  feature  of 
the  Shuttle  Program  is  being  eroded."  The  major  factor 
leading  to  this  concern  "is  the  reduction  in  allocated 
resources  and  appropriate  staff  . . .  There  are  important 
technical  areas  that  are  'one-deep.'  "  Also,  "the  SIAT 
feels  strongly  that  workforce  augmentation  must  be 
realized  principally  with  NASA  personnel  rather  than 
with  contractor  personnel." 

•  The  SiAT  was  concerned  with  "success-engendered 
safety  optimism  ...  The  SSP  must  rigorously  guard 
against  the  tendency  to  accept  risk  solely  because  of 
prior  success." 

•  "The  SIAT  was  very  concerned  with  what  it  perceived  as 
Risk  Management  process  erosion  created  by  the  desire 
to  reduce  costs  ...  The  SiAT  feels  strongly  that  NASA 
Safety  and  Mission  Assurance  should  be  restored  to  its 
previous  role  of  an  independent  oversight  body,  and  not 
be  simply  a  'safety  auditor.'  " 


•  "The  size  and  complexity  of  the  Shuttle  system  and  of 
NASA/contractor  relationships  place  extreme  impor- 
tance on  understanding,  communication,  and  informa- 
tion handling  ...  Communication  of  problems  and  con- 
cerns upward  to  the  SSP  from  the  'floor'  also  appeared 
to  leave  room  for  improvement."''' 

The  Shuttle  independent  Assessment  Team  report  also  stated 
that  the  Shuttle  "clearly  cannot  be  thought  of  as  'operational' 
in  the  usual  sense.  Extensive  maintenance,  major  amounts 
of  'touch  labor'  and  a  high  degree  of  skill  and  expertise  will 
always  be  required."  However,  "the  workforce  has  received 
a  conflicting  message  due  to  the  emphasis  on  achieving  cost 
and  staff  reductions,  and  the  pressures  placed  on  increasing 
scheduled  flights  as  a  result  of  the  Space  Station."'"' 

Responding  to  NASA's  concern  that  the  Shuttle  required 
safety-related  upgrades,  the  President's  proposed  NASA 
budget  for  Fiscal  Year  2001  proposed  a  "safety  upgrades 
initiative."  That  initiative  had  a  short  life  span,  in  its  Fiscal 
Year  2002  budget  request,  NASA  proposed  to  spend  $1,836 
billion  on  Shuttle  upgrades  over  five  years.  A  year  later,  the 
Fiscal  Year  2003  request  contained  a  plan  to  spend  $1,220 
billion  -  a  34  percent  reduction.  The  reductions  were  pri- 
marily a  response  to  rising  Shuttle  operating  costs  and  the 
need  to  stay  within  a  fixed  Shuttle  budget.  Cost  growth  in 
Shuttle  operations  forced  NASA  to  "use  funds  intended  for 
Space  Shuttle  safety  upgrades  to  address  operational,  sup- 
portability,  obsolescence,  and  infrastructure  needs."'*' 

At  its  March  2001  meeting,  NASA's  Space  Flight  Advisory 
Committee  advised  that  "the  Space  Shuttle  Program  must 
make  larger,  more  substantial  safety  upgrades  than  currently 
planned  ...  a  budget  on  the  order  of  three  times  the  budget 
cunently  allotted  for  improving  the  Shuttle  systems"  was 
needed."'^  I^ater  that  year,  five  Senators  complained  that  "the 
Shuttle  program  is  being  penalized,  despite  its  outstanding 
pertormance,  in  order  to  conform  to  a  budget  strategy  that 
is  dangerously  inadequate  to  ensure  safety  in  America's  hu- 
man space  flight  program."'*  (See  Chapter  7  for  additional 
discussion  of  Shuttle  safety  upgrades.) 

Deteriorating  Shuttle  Infrastructure 

The  same  ambiguity  about  investing  in  Shuttle  upgrades  has 
also  affected  the  maintenance  of  Shuttle  Program  ground 
infrastructure,  much  of  which  dates  to  Project  Apollo  and 
1970s  Shuttle  Program  construction.  Figure  5.5-4  depicts  the 
age  of  the  Shuttle's  infrastructure  as  of  2000.  Most  ground 
infrastructure  was  not  built  for  such  a  protracted  lifespan. 
Maintaining  infrastructure  has  been  particularly  difficult  at 
Kennedy  Space  Center,  where  it  is  constantly  exposed  to  a 
salt  water  environment. 

Board  investigators  have  identified  deteriorating  infrastruc- 
ture associated  with  the  launch  pads.  Vehicle  Assembly 
Building,  and  the  crawler  transporter.  Figures  5.5-5  and  5.5-6 
depict  some  of  this  deterioration.  For  example.  NASA  has 
installed  nets,  and  even  an  entire  sub-roof,  inside  the  Vehicle 
Assembly  Building  to  prevent  concrete  from  the  building's 
ceiling  from  hitting  the  Orbiter  and  Shuttle  stack,  in  addi- 
tion, the  corrosion-control  challenge  results  in  zinc  primer 
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Figure  5.5-4.  Age  of  the  Space  Shuffle  infrastrucfure.  (Source:  Con- 
nie Mi/fon  fo  Space  Flighf  Advisory  Council,  2000. 


on  certain  launch  pad  areas  being  exposed  to  the  elements. 
When  rain  fails  on  these  areas,  it  carries  away  zinc,  runs  onto 
the  leading  edge  of  the  Orbiler's  wings,  and  causes  pinholes 
in  the  Reinforced  Carbon-Carbon  panels  (see  Chapter  3). 

In  2000.  NASA  identitied  100  infrastructure  items  that 
demanded  immediate  attention.  NASA  briefed  the  Space 
Flight  Advisory  Committee  on  this  "Infrastructure  Revitai- 
ization"  initiative  in  November  of  that  year.  The  Committee 
concluded  that  "deteriorating  infrastructure  is  a  serious, 
major  problem."  and.  upon  touring  several  Kennedy  Space 
Center  facilities,  declared  them  "in  deplorable  condition."'' 
NASA  subsequently  submitted  a  request  to  the  White  House 
Office  of  Management  and  Budget  during  Fiscal  Year  2002 
budget  deliberations  for  $600  million  to  fund  the  infrastruc- 
ture initiative.  No  funding  was  approved. 

In  Fiscal  Year  2002,  Congress  added  $25  million  to  NASA's 
budget  for  Vehicle  Assembly  Building  repairs.  NASA  has 
reallocated  limited  funds  from  the  Shuttle  budget  to  press- 
ing infrastructure  repairs,  and  intends  to  take  an  integrated 
look  at  infrastructure  as  part  of  its  new  Shuttle  Service 
Life  Extension  Program.  Nonetheless,  like  Space  Shuttle 
upgrades,  infrastructure  revitalization  has  been  mired  by 
the  uncertainty  surrounding  the  Shuttle  Program's  lifetime. 
Considering  that  the  Shuttle  will  likely  be  flying  for  many 
years  to  come.  NASA,  the  White  House,  and  Congress  alike 
now  face  the  specter  of  having  to  deal  with  years  of  infra- 
structure neglect. 


5.6    A  Change  in  NASA  Leadership 

Daniel  Goldin  left  NASA  in  November  2001  after  more 
than  nine  years  as  Administrator.  The  White  House  chose 
Sean  O'Keefe.  the  Deputy  Director  of  the  White  House 
Office  of  Management  and  Budget,  as  his  replacement. 
O'Keefe  stated  as  he  took  office  that  he  was  not  a  "rocket 
scientist."  but  rather  that  his  expertise  was  in  the  manage- 
ment of  large  government  programs.  His  appointment  was 
an  explicit  acknowledgement  by  the  new  Bush  administra- 
tion that  NASA's  primary  problems  were  managerial  and 
financial. 

By  the  time  O'Keefe  arrived.  NASA  managers  had  come  to 
recognize  that  1990s  funding  reductions  for  the  Space  Shut- 
tle Program  had  resulted  in  an  excessively  fragile  program, 
and  also  realized  that  a  Space  Shuttle  replacement  was  not 
on  the  horizon.  In  2002.  with  these  issues  in  mind,  O'Keefe 
made  a  number  of  changes  to  the  Space  Shuttle  Program. 
He  transferred  management  of  both  the  Space  Shuttle  Pro- 
gram and  the  International  Space  Station  from  Johnson 
Space  Center  to  NASA  Headquarters.  O'Keefe  also  began 
considering  whether  to  expand  the  Space  Flight  Opera- 
tions Contract  to  cover  additional  Space  Shuttle  elements, 
or  to  pursue  "competitive  sourcing."  a  Bush  administration 
initiative  that  encouraged  government  agencies  to  compete 
with  the  private  sector  for  management  responsibilities  of 
publicly  funded  activities.  To  research  whether  competitive 
sourcing  would  be  a  viable  approach  for  the  Space  Shuttle 
Program,  NASA  chartered  the  Space  Shuttle  Competitive 
Sourcing  Task  Force  through  the  RAND  Corporation,  a 
federally  funded  think  tank.  In  its  report,  the  Task  Force  rec- 
ognized the  many  obstacles  to  transferring  the  Space  Shuttle 
to  non-NASA  management,  primarily  NASA's  reticence  to 
relinquish  control,  but  concluded  that  "NASA  must  pursue 
competitive  sourcing  in  one  form  or  another."'"" 

NASA  began  a  "Strategic  Management  of  Human  Capital" 
initiative  to  ensure  the  quality  of  the  future  NASA  work- 
force. The  goal  is  to  address  the  various  external  and  internal 
challenges  that  NASA  faces  as  it  tries  to  ensure  an  appropri- 
ate mix  and  depth  of  skills  for  future  program  requirements. 
A  number  of  aspects  to  its  Strategic  Human  Capital  Plan 
require  legislative  approval  and  are  currently  before  the 
Congress. 


Figure  5  5-5  and  5  5-6.  Examples  of  fhe  seriously  deferiorafing  infrastructure  used  to  support  the  Space  Shuttle  Program.  At  left  is  launch 
Complex  39A,  and  at  right  is  the  Vehicle  Assembly  building,  both  at  fhe  Kennedy  Space  Center. 
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The  new  NASA  leadership  also  began  to  compare  Space 
Shuttle  program  practices  with  the  practices  of  similar 
high-technology,  high-risk  enterprises.  The  Navy  nuclear 
submarine  program  was  the  first  enterprise  selected  for  com- 
parative analysis.  An  interim  report  on  this  "benchmarking" 
effort  was  presented  to  NASA  in  December  2002.''" 

In  November  2002,  NASA  made  a  fundamental  change  in 
strategy,  in  what  was  called  the  Integrated  Space  Transpor- 
tation Plan  (see  Figure  5.6-1),  NASA  shifted  money  from 
the  Space  Launch  Initiative  to  the  Space  Shuttle  and  Inter- 
national Space  Station  programs.  The  plan  also  introduced 
the  Orbital  Space  Plane  as  a  complement  to  the  Shuttle  for 
the  immediate  future.  Under  this  strategy,  the  Shuttle  is  to 
fly  through  at  least  2010,  when  a  decision  will  be  made  on 
how  long  to  extend  Shuttle  operations  -  possibly  through 
2020  or  even  beyond. 

As  a  step  in  implementing  the  plan,  NASA  included  $281 .4 
million  in  its  Fi.scal  Year  2004  budget  submission  to  begin 
a  Shuttle  Service  Life  Extension  Program.'"  which  NASA 
describes  as  a  "strategic  and  proactive  program  designed  to 
keep  the  Space  Shuttle  Hying  safely  and  efficiently."  The 
program  includes  "high  priority  projects  for  safety,  support- 
ability,  and  infrastructure"  in  order  to  "combat  obsolescence 
of  vehicle,  oround  systems,  and  facilities."  ' 


Figure  5.6-1.  The  Integrated  Space  Transportation  Plan. 


5.  7  The  Return  of  Schedule  Pressure 

The  International  Space  Station  has  been  the  centerpiece  of 
NASA's  human  space  flight  program  in  the  1990s.  In  several 
instances,  funds  for  the  Shuttle  Program  have  paid  for  vari- 
ous International  Space  Station  items.  The  Space  Station  has 
also  affected  the  Space  Shuttle  Program  schedule.  By  the 
time  the  functional  cargo  block  Zarya.  the  Space  Station's 
first  element,  was  launched  from  the  Baikonur  Cosmodrome 
in  Kazakhstan  in  November  1998,  the  Space  Station  was 
two  years  behind  schedule.  The  launch  of  STS-88.  the  first 
of  many  Shuttle  missions  assigned  to  station  assembly,  fol- 
lowed a  month  later.  Another  four  assembly  missions  in 
1999  and  2000  readied  the  station  for  its  first  permanent 
crew.  Expedition  I,  which  arrived  in  late  2000. 


When  the  Bush  Administration  came  to  the  White  House  in 
January  2001,  the  International  Space  Station  program  was 
$4  billion  over  its  projected  budget.  The  Administration's 
Fiscal  Year  2002  budget,  released  in  February  2001,  de- 
clared that  the  International  Space  Station  would  be  limited 
to  a  "U.S  Core  Complete"  configuration,  a  reduced  design 
that  could  accommodate  only  three  crew  members.  The 
last  step  in  completing  the  U.S.  portion  of  this  configura- 
tion would  be  the  addition  of  the  Italian-supplied  but  U.S.- 
owned  "Node  2,"  which  would  allow  Europe  and  Japan  to 
connect  their  laboratory  modules  to  the  Station.  Launching 
Node  2  and  thereby  finishing  "core  complete"  configuration 
became  an  important  political  and  programmatic  milestone 
(see  Figure  5.7-1 ). 


Figure  5.7-1.   The   "Core  Complete"  configuration  of  the  Interna- 
tional Space  Station. 


During  congressional  testimony  in  May  of  2001,  Sean 
O'Keefe,  who  was  then  Deputy  Director  of  the  White  House 
Office  of  Management  and  Budget,  presented  the  Adminis- 
tration's plan  to  bring  International  Space  Station  costs  un- 
der control.  The  plan  outlined  a  reduction  in  assembly  and 
logistics  flights  to  reach  "core  complete"  configuration  from 
36  to  30.  It  also  recommended  redirecting  about  $1  billion  in 
funding  by  canceling  U.S.  elements  not  yet  completed,  such 
as  the  habitation  module  and  the  X-38  Crew  Return  Vehicle. 
The  X-38  would  have  allowed  emergency  evacuation  and 
landing  capability  for  a  seven-member  station  crew.  Without 
it,  the  crew  was  limited  to  three,  the  number  that  could  fit 
into  a  Russian  Soyuz  crew  rescue  vehicle. 

In  his  remarks,  O'Keefe  stated: 

NASA ',v  deiiree  of  success  in  i^aiiiiiiii  control  of  cos! 
growth  on  Space  Station  will  not  only  dictate  the  ca- 
pabilities that  the  Station  wUl  provide,  but  will  send  a 
stron^i  signal  about  the  ability  of  NASA's  Human  Space 
Fliiiht  program  to  effectively  manage  large  development 
programs.  NASA's  credibility  with  the  Administration 
and  the  Congress  for  delivering  on  what  is  promised 
and  the  longer-term  implications  that  such  credibility 
may  have  on  the  future  of  Human  Space  Flight  hang  in 
the  balance.^- 

At  the  request  of  the  White  House  Office  of  Management 
and  Budget,  in  July  2001  NASA  Administrator  Dan  Goldin 
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formed  an  International  Space  Station  Management  and 
Cost  Evaluation  Task  Force.  The  International  Space  Station 
Management  and  Cost  Evaluation  Task  Force  was  to  assist 
NASA  in  identifying  the  reforms  needed  to  restore  the  Sta- 
tion Program's  fiscal  and  management  credibility. 

While  the  primary  focus  of  the  Task  Force  was  on  the  Space 
Station  Program  management,  its  November  2001  report 
issued  a  general  condemnation  of  how  NASA,  and  particu- 
larly Johnson  Space  Center,  had  managed  the  Internatiiinal 
Space  Station,  and  by  implication,  NASA's  overall  human 
space  flight  effort.  '  The  report  noted  '"existing  deficien- 
cies in  management  structure,  institutional  culture,  cost 
estimating,  and  program  control."  and  that  "the  institutional 
needs  of  the  [human  space  flight]  Centers  are  dri\ing  the 
Program,  rather  than  Program  requirements  being  served  by 
the  Centers."  The  Task  Force  suggested  that  as  a  cost  control 
measure,  the  Space  Shuttle  be  limited  to  four  flights  per  year 
and  that  NASA  revise  the  station  crew  rotation  period  to  six 
months.  The  cost  savings  that  would  result  from  eliminating 
flights  could  be  used  to  offset  cost  overruns. 

NASA  accepted  a  reduced  flight  rate.  The  Space  Shuttle  Pro- 
gram ofhce  concluded  that,  based  on  a  rate  of  four  flights  a 
year.  Node  2  could  be  launched  by  February  19,  2004. 

In  testimony  before  the  House  Committee  on  Science  on 
November  7.  2001.  Task  Force  Chairman  Thomas  Young 
identified  what  became  known  as  a  "performance  gate."  He 
suggested  that  over  the  next  two  years,  NASA  should  plan 
and  implement  a  credible  "'core  complete"  program.  In  Fall 
2003,  "an  assessment  would  be  made  concerning  the  ISS 
program  performance  and  NASA's  credibility.  If  satisfac- 
tory, resource  needs  would  be  assessed  and  an  (ISS]  "end 
state"  that  realized  the  science  potential  would  become  the 
baseline.  If  unsatisfactory,  the  core  complete  program  would 
become  the  "end  state.'  "■■* 

Testifying  the  same  day.  Office  of  Management  and  Budget 
Deputy  Director  Sean  O'Keefe  indicated  the  Administra- 
tion's agreement  with  the  planned  performance  gate: 

The  concept  presented  by  the  task  force  of  u  decision 
f^ate  in  tH'o  years  that  could  lead  to  an  end  state  other 
than  the  U.S.  core  complete  Station  is  an  innovative  ap- 
proach, and  one  the  Administration  will  adopt.  It  calls 
for  NASA  to  make  the  necessary  mana^iement  reforms  to 
successfully  build  the  core  complete  Station  and  oper- 
ate it  within  the  $H.3  billion  available  throufih  FY  2006 
plus  other  human  space  flight  resmirces  . . .  If  NASA  fails 
to  meet  the  standards,  then  an  end-state  beyond  core 
complete  is  not  an  option.  The  stratef^y  places  the  bur- 
den of  proof  on  NASA  performance  to  ensure  that  NASA 
fully  implements  the  needed  reforms.^'' 

Mr  O'Keefe  added  in  closing: 

A  most  important  next  step  -  one  on  which  the  success  of 
all  these  reforms  hinf>es  -  is  to  provide  new  leadership 
for  NASA  and  its  Human  Space  Flight  activities.  NASA 
has  been  well-served  by  Dan  Goldin.  New  leadership 
is  now  necessary  to  continue  moviiiii  the  hall  down  the 


field  with  the  goal  line  in  sight.  The  Administration  rec- 
ognizes the  importance  of  getting  the  right  leaders  in 
place  as  .soon  as  possible,  and  I  am  personalty  engaged 
in  making  sure  that  this  happens. 

A  week  later,  Sean  O'Keefe  was  nominated  by  President 
Bush  as  the  new  NASA  Administrator. 

To  meet  the  new  flight  schedule,  in  2002  NASA  revised  its 
Shuttle  manifest,  calling  for  a  docking  adaptor  to  be  installed 
in  Columbia  after  the  STS- 107  mission  so  that  it  could  make 
an  October  2003  flight  to  the  International  Space  Station. 
Columbia  was  not  optimal  for  Station  flights  -  the  Orbiter 
could  not  carry  enough  payload  -  but  it  was  assigned  to  this 
flight  because  Discovery  was  scheduled  for  18  months  of 
major  maintenance.  To  ensure  adequate  Shuttle  availability 
for  the  February  2004  Node  2  launch  date,  Columbia  would 
fly  an  International  Space  Station  resupply  mission. 

The  White  House  and  Congress  had  put  the  International 
Space  Station  Program,  the  Space  Shuttle  Program,  and 
indeed  NASA  on  probation.  NASA  had  to  prove  it  could 
meet  schedules  within  cost,  or  risk  halting  Space  Station 
construction  at  core  complete  -  a  configuration  far  short 
of  what  NASA  anticipated.  The  new  NASA  management 
viewed  the  achievement  of  an  on-schedule  Node  2  launch 
as  an  endorsement  of  its  successful  approach  to  Shuttle  and 
Station  Programs.  Any  suggestions  that  it  would  be  difficult 
to  meet  that  launch  date  were  brushed  aside. 

This  insistence  on  a  fixed  launch  schedule  was  worrisome. 
The  International  Space  Station  Management  and  Cost 
Evaluation  Task  Force,  in  particular,  was  concerned  with 
the  emphasis  on  a  specific  launch  date.  It  noted  in  its  2002 
review  of  progress  toward  meeting  its  recommendations  that 
"significant  progress  has  been  made  in  nearly  all  aspects  of 
the  ISS  Program,"  but  that  there  was  "significant  risk  with 
the  Node  2  (February  '04)  schedule."'" 

By  November  2002,  NASA  had  flown  16  Space  Shuttle 
missions  dedicated  to  Station  assembly  and  crew  rotation. 
Five  crews  had  lived  onboard  the  Station,  the  last  four 
of  them  delivered  via  Space  Shuttles.  As  the  Station  had 
grown,  so  had  the  complexity  of  the  missions  required  to 
complete  it.  With  the  International  Space  Station  assembly 
more  than  half  complete,  the  Station  and  Shuttle  programs 
had  become  irreversibly  linked.  Any  problems  with  or  per- 
turbations to  the  planned  schedule  of  one  program  rever- 
berated through  both  programs.  For  the  Shuttle  program, 
this  meant  that  the  conduct  of  all  missions,  even  non-Sta- 
tion missions  like  STS- 107,  would  have  an  impact  on  the 
Node  2  launch  date. 

In  2002,  this  reality,  and  the  events  of  the  months  that  would 
follow,  began  to  place  additional  schedule  pressures  on  the 
Space  Shuttle  Program.  Those  pressures  are  discussed  in 
Section  6.2. 

5.8    Conclusion 

Over  the  last  decade,  the  Space  Shuttle  Program  has  oper- 
ated in  a  challeneins  and  often  turbulent  environment.  As 
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discussed  in  this  chapter,  there  were  at  least  three  major 
contributing  factors  to  that  environment: 

•  Throughout  the  decade,  the  Shuttle  Program  has  had 
to  function  within  an  increasingly  constrained  budget. 
Both  the  Shuttle  budget  and  workforce  have  been  re- 
duced by  over  40  percent  during  the  past  decade.  The 
White  House,  Congress,  and  NASA  leadership  exerted 
constant  pressure  to  reduce  or  at  least  freeze  operating 
costs.  As  a  result,  there  was  little  margin  in  the  budget 
to  deal  with  unexpected  technical  problems  or  make 
Shuttle  improvements. 

•  The  Shuttle  was  mischaracterized  by  the  1995  Kraft 
Report  as  "a  mature  and  reliable  system  ...  about  as 
safe  as  today's  technology  will  provide."  Based  on 
this  mischaracterization,  NASA  believed  that  it  could 
turn  increased  responsibilities  for  Shuttle  operations 
over  to  a  single  prime  contractor  and  reduce  its  direct 
involvement  in  ensuring  safe  Shuttle  operations,  in- 
stead monitoring  contractor  performance  from  a  more 
detached  position.  NASA  also  believed  that  it  could  use 
the  "mature"  Shuttle  to  carry  out  operational  missions 
withput  continually  focusing  engineering  attention  on 
understanding  the  mission-by-mission  anomalies  inher- 
ent in  a  developmental  vehicle. 

•  In  the  1990s,  the  planned  date  for  replacing  the  Shuttle 
shifted  from  2006  to  2012  and  then  to  2015  or  later. 
Given  the  uncertainty  regarding  the  Shuttle's  service 
life,  there  has  been  policy  and  budgetary  ambivalence 
on  investing  in  the  vehicle.  Only  in  the  past  year  has 
NASA  begun  to  provide  the  resources  needed  to  sus- 
tain extended  Shuttle  operations.  Previously,  safety  and 
support  upgrades  were  delayed  or  deferred,  and  Shuttle 
infrastructure  was  allowed  to  deteriorate. 

The  Board  observes  that  this  is  hardly  an  environment  in 
which  those  responsible  for  safe  operation  of  the  Shuttle  can 
function  without  being  influenced  by  external  pressures,  ft 
is  to  the  credit  of  Space  Shuttle  managers  and  the  Shuttle 
workforce  that  the  vehicle  was  able  to  achieve  its  program 
objectives  for  as  long  as  it  did. 

An  examination  of  the  Shuttle  Program's  history  from 
Challeiiiier  to  Coliinihia  raises  the  question:  Did  the  Space 
Shuttle  Program  budgets  constrained  by  the  White  House 
and  Congress  threaten  safe  Shuttle  operations?  There  is  no 
straightforward  answer.  In  1994,  an  analysis  of  the  Shuttle 
budget  concluded  that  reductions  made  in  the  early  1990s 
represented  a  "healthy  tightening  up"  of  the  program.'" 
Certainly  those  in  the  Ofrtce  of  Management  and  Budget 
and  in  NASA's  congressional  authorization  and  appropria- 
tions subcommittees  thought  they  were  providing  enough 
resources  to  operate  the  Shuttle  safely,  while  also  taking  into 
account  the  expected  Shuttle  lifetime  and  the  many  other  de- 
mands on  the  Federal  budget.  NASA  Headcjuarters  agreed, 
at  least  until  Administrator  Goldin  declared  a  "space  launch 
crisis"  in  June  1999  and  asked  that  additional  resources  for 
safety  upgrades  be  added  to  the  NASA  budget.  By  2001, 
however,  one  experienced  observer  of  the  space  program 
described  the  Shuttle  workforce  as  "The  Few.  the  Tired." 


and  suggested  that  "a  decade  of  downsizing  and  budget 
tightening  has  left  NASA  exploring  the  universe  with  a  less 
experienced  staff  and  older  equipment.""** 

It  is  the  Board's  view  that  this  latter  statement  is  an  accurate 
depiction  of  the  Space  Shuttle  Program  at  the  time  of  STS- 
107.  The  Program  was  operating  too  close  to  too  many  mar- 
gins. The  Board  also  finds  that  recent  modest  increases  in  the 
Shuttle  Program's  budget  are  necessary  and  overdue  steps 
toward  providing  the  resources  to  sustain  the  program  for  its 
now-extended  lifetime.  Similarly,  NASA  has  recently  recog- 
nized that  providing  an  adequately  sized  and  appropriately 
trained  workforce  is  critical  to  the  agency's  future  success. 

An  examination  of  the  Program's  management  changes 
also  leads  to  the  question:  Did  turmoil  in  the  management 
structure  contribute  to  the  accident?  The  Board  found  no 
evidence  that  the  transition  from  many  Space  Shuttle  con- 
tractors to  a  partial  consolidation  of  contracts  under  a  single 
firm  has  by  itself  introduced  additional  technical  risk  into 
the  Space  Shuttle  Program.  The  transfer  of  responsibilities 
that  has  accompanied  the  Space  Flight  Operations  Contract 
has,  however,  complicated  an  already  complex  Program 
structure  and  created  barriers  to  effective  communica- 
tion. Designating  the  Johnson  Space  Center  as  the  "lead 
center"  for  the  Space  Shuttle  Program  did  resurrect  some 
of  the  Center  rivalries  and  communication  difficulties  that 
existed  before  the  Challent'er  accident.  The  specific  ways 
in  which  this  complexity  and  lack  of  an  integrated  approach 
to  Shuttle  management  impinged  on  NASA's  performance 
during  and  before  the  flight  of  STS-107  are  discussed  in 
Chapters  6  and  7. 

As  the  21st  century  began,  NASA's  deeply  ingrained  human 
space  flight  culture  -  one  that  has  evolved  over  30  years  as 
the  basis  for  a  more  conservative,  less  technically  and  orga- 
nizationally capable  organization  than  the  Apollo-era  NASA 
-  remained  strong  enough  to  resist  external  pressures  for  ad- 
aptation and  change.  At  the  time  of  the  launch  of  STS-107. 
NASA  retained  too  many  negative  (and  also  many  positive) 
aspects  of  its  traditional  culture:  "flawed  decision  making, 
self  deception,  introversion  and  a  diminished  curiosity  about 
the  world  outside  the  perfect  place."'''  These  characteristics 
were  reflected  in  NASA's  less  than  stellar  performance  be- 
fore and  during  the  STS-107  mission,  which  is  described  in 
the  following  chapters. 
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Chapter  6 


Decision  Making 
at  NASA 


The  dwindling  post-Cold  War  Shuttle  budget  that  launched 
NASA  leadership  on  a  crusade  for  efficiency  in  the  decade 
before  Colnnihia's  final  flight  powerfully  shaped  the  envi- 
ronment in  which  Shuttle  managers  worked.  The  increased 
organizational  complexity,  transitioning  authority  struc- 
tures, and  ambiguous  working  relationships  that  defined 
the  restructured  Space  Shuttle  Program  in  the  1990s  created 
turbulence  that  repeatedly  influenced  decisions  made  before 
and  during  STS-107. 

This  chapter  connects  Chapter  5's  analysis  of  NASA's 
broader  policy  environment  to  a  focused  scrutiny  of  Space 
Shuttle  Program  decisions  that  led  to  the  STS-107  accident. 
Section  6.1  illustrates  how  foam  debris  losses  that  violated 
design  requirements  came  to  be  defined  by  NASA  manage- 
ment as  an  acceptable  aspect  of  Shuttle  missions,  one  that 
posed  merely  a  maintenance  "turnaround"  problem  rather 
than  a  safety-of-flight  concern.  Section  6.2  shows  how.  at  a 
pivotal  juncture  just  months  before  the  Coliiinbiu  accident, 
the  management  goal  of  completing  Node  2  of  the  interna- 
tional Space  Station  on  time  encouraged  Shuttle  managers 
to  continue  flying,  even  after  a  significant  bipod-foam  debris 
strike  on  STS-II2.  Section  6.3  notes  the  decisions  made 
during  STS-107  in  response  to  the  bipod  foam  strike,  and 
reveals  how  engineers'  concerns  about  risk  and  safety  were 
competing  with  -  and  were  defeated  by  -  management's  be- 
lief that  foam  could  not  hurt  the  Orbiter,  as  well  as  the  need 
to  keep  on  schedule,  in  relating  a  rescue  and  repair  scenario 
that  might  have  enabled  the  crew's  safe  return.  Section  6.4 
grapples  with  yet  another  latent  assumption  held  by  Shuttle 
managers  during  and  after  STS-107:  that  even  if  the  foam 
strike  had  been  discovered,  nothing  could  have  been  done. 

6.1    A  History  OF  Foam  Anomalies 

The  shedding  of  External  Tank  foam  -  the  physical  cause  of 
the  Columbia  accident  -  had  a  long  history.  Damage  caused 
by  debris  has  occurred  on  every  Space  Shuttle  flight,  and 
most  missions  have  had  insulating  foam  shed  during  ascent. 
This  raises  an  obvious  question:  Why  did  NASA  continue 


flying  the  Shuttle  with  a  known  problem  that  violated  de- 
sign requirements?  it  would  seem  that  the  longer  the  Shuttle 
Program  allowed  debris  to  continue  striking  the  Orbiters, 
the  more  opportunity  existed  to  detect  the  serious  threat  it 
posed.  But  this  is  not  what  happened.  Although  engineers 
have  made  numerous  changes  in  foam  design  and  applica- 
tion in  the  25  years  that  the  External  Tank  has  been  in  pro- 
duction, the  problem  of  foam-shedding  has  not  been  solved, 
nor  has  the  Orbiter's  ability  to  tolerate  impacts  from  foam 
or  other  debris  been  significantly  improved. 

The  Need  for  Foam  Insulation 

The  External  Tank  contains  liquid  oxygen  and  hydrogen 
propellants  stored  at  minus  297  and  minus  423  degrees  Fahr- 
enheit. Were  the  super-cold  External  Tank  not  sufficiently  in- 
sulated from  the  warm  air,  its  liquid  propellants  would  boil, 
and  atmospheric  nitrogen  and  water  vapor  would  condense 
and  form  thick  layers  of  ice  on  its  surface.  Upon  launch,  the 
ice  could  break  off  and  damage  the  Orbiter.  (See  Chapter  3.) 

To  prevent  this  from  happening,  large  areas  of  the  Exter- 
nal Tank  are  machine-.sprayed  with  one  or  two  inches  of 
foam,  while  specific  fixtures,  such  as  the  bipod  ramps,  are 
hand-sculpted  with  thicker  coats.  Most  of  these  insulating 
materials  fall  into  a  general  category  of  "foam,"  and  are 
outwardly  similar  to  hardware  store-sprayable  foam  insula- 
tion. The  problem  is  that  foam  does  not  always  stay  where 
the  External  Tank  manufacturer  Lockheed  Martin  installs  it. 
During  flight,  popcorn-  to  briefcase-size  chunks  detach  from 
the  External  Tank. 

Original  Design  Requirements 

Early  in  the  Space  Shuttle  Program,  foam  loss  was  consid- 
ered a  dangerous  problem.  Design  engineers  were  extremely 
concerned  about  potential  damage  to  the  Orbiter  and  its 
fragile  Thermal  Protection  System,  parts  of  which  are  so 
vulnerable  to  impacts  that  lightly  pressing  a  thumbnail  into 
them  leaves  a  mark.  Because  of  these  concerns,  the  baseline 
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design  requirements  in  the  Shuttle's  "Flight  and  Ground 
System  Specification-Book  I,  Requirements,"  precluded 
foam-shedding  by  the  External  Tank.  Specifically: 

3.2.1.2.14  Debris  Prevention:  The  Space  Shuttle  Sys- 
tem, inchidiiii;  the  iiroiiml  systems,  shall  he  desifiued  to 
preclude  the  sheddiiii;  of  ice  and/or  other  debris  from 
the  Shuttle  elements  dnrini^  prelaiuich  and  fli,i;ht  op- 
erations that  would  Jeopardize  the  frif>ht  crew,  vehicle, 
mission  success,  or  would  adversely  impact  turnaround 
operations. ' 

3.2.1.1.17  External  Tank  Debris  Limits:  No  debris 
shall  emanate  from  the  critiad  zone  of  the  External 
Tank  on  the  launch  pad  or  diirini>  ascent  except  for  such 
material  which  may  result  from  normal  thermal  protec- 
tion system  recession  due  to  ascent  heatinf^r 

The  assumption  that  only  tiny  pieces  of  debris  would  strike 
the  Orbiter  was  also  built  into  original  design  requirements, 
which  specified  that  the  Thermal  Protection  System  (the 
tiles  and  Reinforced  Carbon-Carbon,  or  RCC,  panels)  would 
be  built  to  withstand  impacts  with  a  kinetic  energy  less  than 
0.006  foot-pounds.  Such  a  small  tolerance  leaves  the  Orbiter 
vulnerable  to  strikes  from  birds,  ice,  launch  pad  debris,  and 
pieces  of  foam. 

Despite  the  design  requirement  that  the  External  Tank  shed 
no  debris,  and  that  the  Orbiter  not  be  subjected  to  any  sig- 
nificant debris  hits,  Columbia  sustained  damage  from  debris 
strikes  on  its  inaugural  1981  flight.  More  than  300  tiles  had 
to  be  replaced.'  Engineers  .stated  that  had  they  known  in  ad- 
vance that  the  External  Tank  "was  going  to  produce  the  de- 
bris shower  that  occurred"  during  launch,  "they  would  have 
had  a  difficult  time  clearing  Columbia  for  flight."'^ 

Discission  of  Foam  Strikes 
Prior  to  the  Rogers  Commission 

Foam  strikes  were  a  topic  of  management  concern  at  the 
time  of  the  Challen,^er  accident.  In  fact,  during  the  Rog- 
ers Commission  accident  investigation.  Shuttle  Program 
Manager  Arnold  Aidrich  cited  a  contractor's  concerns  about 
foam  shedding  to  illustrate  how  well  the  Shuttle  Program 
manages  risk: 

On  a  series  of  four  or  five  external  tanks,  the  thermal 
insulation  around  the  inner  tank  ...  had  large  divots 
of  insulation  comini>  off  and  impacting  the  Orbiter 
We  found  significant  amount  of  damage  to  one  Orbiter 
after  a  flight  and  . . .  on  the  subsequent  flight  we  had  a 
camera  in  the  equivalent  of  the  wheel  well,  which  took  a 
picture  of  the  tank  after  separation,  and  we  determined 
that  this  was  in  fact  the  cause  of  the  ckunage.  At  that 
time,  we  wanted  to  be  able  to  proceed  with  the  launch 
program  if  it  was  acceptable  . . .  so  we  undertook  discus- 
sions of  what  would  be  acceptable  in  terms  of  potential 
field  repairs,  and  during  those  discussions.  Rockwell 
was  very  conservative  because,  rightly,  damage  to  the 
Orbiter  TPS  [Thermal  Protection  System  j  is  damage  to 
the  Orbiter  system,  and  it  has  a  very  stringent  environ- 
ment to  experience  during  the  re-entrv  phase. 


Aidrich  described  the  pieces  of  foam  as  "...  half  a  foot 
square  or  a  foot  by  half  a  foot,  and  some  of  them  much 
smaller  and  localized  to  a  specific  area,  but  fairly  high  up  on 
the  tank.  So  they  had  a  good  shot  at  the  Orbiter  underbelly, 
and  this  is  where  we  had  the  damage."^ 

Continuing  Foam  Loss 

Despite  the  high  level  of  concern  after  STS-I  and  through 
the  Challenger  accident,  foam  continued  to  separate  from 
the  External  Tank.  Photographic  evidence  of  foam  shedding 
exists  for  65  of  the  79  missions  for  which  imagery  is  avail- 
able. Of  the  34  missions  for  which  there  are  no  imagery,  8 
missions  where  foam  loss  is  not  seen  in  the  imagery,  and  6 
missions  where  imagery  is  inconclusive,  foam  loss  can  be 
inferred  from  the  number  of  divots  on  the  Orbiter's  lower 
surfaces.  Over  the  life  of  the  Space  Shuttle  Program.  Orbit- 
ers  have  returned  with  an  average  of  143  divots  in  the  upper 
and  lower  surfaces  of  the  Thermal  Protection  System  tiles, 
with  31  divots  averaging  over  an  inch  in  one  dimension.'' 
(The  Orbiters'  lower  surfaces  have  an  average  of  10!  hits, 
23  of  which  are  larger  than  an  inch  in  diameter.)  Though 
the  Orbiter  is  also  struck  by  ice  and  pieces  of  launch-pad 
hardware  during  launch,  by  micromeleoroids  and  orbital 
debris  in  space,  and  by  runway  debris  during  landing,  the 
Board  concludes  that  foam  is  likely  responsible  for  most 
debris  hits. 

With  each  successful  landing,  it  appears  that  NASA  engi- 
neers and  managers  increasingly  regarded  the  foam-shed- 
ding as  inevitable,  and  as  either  unlikely  to  jeopardize  safety 
or  simply  an  acceptable  risk.  The  distinction  between  foam 
loss  and  debris  events  also  appears  to  have  become  bluired. 
NASA  and  contractor  personnel  came  to  view  foam  strikes 
not  as  a  safety  of  flight  issue,  but  rather  a  simple  mainte- 
nance, or  "turnaround"  issue.  In  Flight  Readiness  Review 
documentation.  Mission  Management  Team  minutes,  In- 
Flight  Anomaly  disposition  reports,  and  elsewhere,  what 
was  originally  considered  a  serious  threat  to  the  Orbiter 


Definitions 

In  Family:  A  reportable  problem  that  was  previously  experi- 
enced, analyzed,  and  understood.  Out  ol  limits  performance 
or  discrepancies  that  have  been  previously  experienced  may 
be  considered  as  in-family  when  specifically  approved  by  the 
Space  Shuttle  Program  or  design  project.** 

Out  of  Family:  Operation  or  peifomiance  outside  the  ex- 
pected performance  range  for  a  given  parameter  or  which  has 
not  previously  been  experienced.'' 

Accepted  Risk:  The  threat  as.sociated  with  a  specific  cir- 
cumstance is  known  and  understood,  cannot  be  completely 
eliminated,  and  the  circumstance(s)  producing  that  threat  is 
considered  unlikely  to  reoccur  Hence,  the  circumstance  is 
fully  known  and  is  considered  a  tolerable  threat  to  the  con- 
duct of  a  Shuttle  mission. 

No  Safety-of-Flight-lssuc:  The  threat  associated  with  a 
specific  circumstance  is  known  and  understood  and  does  not 
pose  a  threat  to  the  crew  and/or  vehicle. 
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Figure  6.1-7.  There  have  been  seven  known  cases  where  the  left  External  Tank  bipod  ramp  foam  has  come  off  in  flight. 


came  to  be  treated  as  "in-family.""  a  reportable  problem  that 
was  within  the  known  experience  base,  was  believed  to  be 
understood,  and  was  not  regarded  as  a  safety-of-flight  issue. 

Bipod  Ramp  Foam  Loss  Events 

Chunks  of  foam  from  the  E.xternal  Tank's  forward  bipod 
attachment,  which  connects  the  Orbiter  to  the  External 
Tank,  are  some  of  the  largest  pieces  of  debris  that  have 
struck  the  Orbiter.  To  place  the  foam  loss  from  STS-107 
in  a  broader  context,  the  Board  examined  every  known 
instance  of  foam-shedding  from  this  area.  Foam  loss  from 
the  left  bipod  ramp  (called  the  -Y  ramp  in  NASA  parlance) 
has  been  confirmed  by  imagery  on  7  of  the  113  missions 
flown.  However,  only  on  72  ofthe.se  missions  was  available 
imagery  of  sufficient  quality  to  determine  left  bipod  ramp 
foam  loss.  Therefore,  foam  loss  from  the  left  bipod  area  oc- 
curred on  approximately  10  percent  of  flights  (seven  events 
out  of  72  imaged  flights).  On  the  66  flights  that  imagery 
was  available  for  the  right  bipod  area,  foam  loss  was  never 
observed.  NASA  could  not  explain  why  only  the  left  bipod 
experienced  foam  loss.  (See  Figure  6.1-1.) 


The  first  know  n  bipod  ramp  foam  loss  occurred  during  STS-7. 
Challeni^er's  second  mission  (see  Figure  6.1-2).  Images 
taken  after  External  Tank  separation  revealed  that  a  19-  by 
1 2-inch  piece  of  the  left  bipod  ramp  was  missing,  and  that  the 
External  Tank  had  some  25  shallow  divots  in  the  foam  just 
forward  of  the  bipod  struts  and  another  40  divots  in  the  foam 
covering  the  lower  External  Tank.  After  the  mission  was 
completed,  the  Program  Requirements  Control  Board  cited 
the  foam  loss  as  an  In-Flight  Anomaly.  Citing  an  event  as  an 
In-Flight  Anomaly  means  that  before  the  next  launch,  a  spe- 
cific NASA  organization  must  resolve  the  problem  or  prove 
that  it  does  not  threaten  the  safety  of  the  vehicle  or  crew." 

At  the  Flight  Readiness  Review  for  the  next  mission.  Orbiter 
Project  management  reported  that,  based  on  the  completion 
of  repairs  to  the  Orbiter  Thermal  Protection  System,  the 
bipod  ramp  foam  loss  In-Flight  Anomaly  was  resolved,  or 
"closed."  However,  although  the  closure  documents  detailed 
the  repairs  made  to  the  Orbiter.  neither  the  Certificate  of 
Flight  Readiness  documentation  nor  the  Flight  Readiness 
Review  documentation  referenced  correcting  the  cause  of 
the  damaee  -  the  slicddins  of  foam. 


Figure  6.1-2.  The  first  known  instance  of  bipod  ramp  shedding  oc- 
curred on  STS-7  which  was  launched  on  June  18,   1983. 


Figure  6.1-3.  Only  three  months  before  the  Final  launch  of  Colum- 
bia, the  bipod  ramp  foam  had  come  off  during  STS112. 
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Umbilical  Cameras  and  the 
Statistics  of  Bipod  Ramp  Loss 

Over  llie  course  of  the  1 13  Space  Shuttle  missions,  the  left 
bipod  ramp  has  shed  significant  pieces  ol  foam  at  least  seven 
times.  (Foam-shedding  from  the  right  bipod  ramp  has  never 
been  confirmed.  The  right  bipod  ramp  may  be  less  subject  to 
foam  shedding  because  it  is  partially  shielded  from  aerody- 
namic forces  by  the  Kxlernal  Tank's  liquid  oxygen  line.)  The 
fact  that  five  of  these  left  bipod  shedding  events  occurred 
on  missions  flown  by  Coliiiribia  sparked  considerable  Board 
debate.  Although  initially  this  appeared  to  be  a  ini|>robable 
coincidence  that  would  have  caused  the  Board  to  fault  NASA 
for  improper  trend  analysis  and  lack  of  engineering  curiosity, 
on  closer  in.spection,  the  Board  concluded  that  this  "coinci- 
dence" is  probably  the  result  of  a  bias  in  the  sample  of  known 
bipod  foam-shedding.  Before  the  Cluilleiii^cr  accident,  only 
Challenger  and  Colitnihia  carried  umbilical  well  cameras 
that  imaged  the  External  Tank  after  separation,  so  there  are 
more  images  of  Cnhiinhia  than  of  the  other  Orbiters. '" 

The  bipod  was  imaged  26  of  28  of  Coliiiiit?ia's  missions;  in 
contrast.  Challenger  had  7  of  10,  Discovery  had  only  14  of 
30,  Atlantis  only  14  of  26.  and  Endeavour  12  of  19. 


The  second  bipod  ramp  foam  loss  occurred  during  STS-32R. 
Coliiinhia's  ninth  flight,  on  January  9.  1990.  A  post-mission 
review  of  STS-32R  photography  revealed  hve  divots  in  the 
intertank  foam  ranging  from  6  to  28  inches  in  diameter,  the 
largest  of  which  extended  into  the  left  bipod  ramp  foam.  A 
post-mission  inspection  of  the  lower  suil^'ace  of  the  Orbiter 
revealed  1 1 1  hits.  13  of  which  were  one  inch  or  greater  in 
one  dimension.  An  In-Flight  Anomaly  assigned  to  the  Ex- 
ternal Tank  Project  was  closed  out  at  the  Flight  Readiness 
Review  for  the  next  mission,  STS-36.  on  the  basis  that  there 
may  have  been  local  voids  in  the  foam  bipod  ramp  where 
it  attached  to  the  metal  skin  of  the  External  Tank.  To  ad- 
dress the  foam  loss,  NASA  engineers  poked  small  "vent 
holes"  through  the  intertank  foam  to  allow  trapped  gases  to 
escape  voids  in  the  foam  where  they  otherwise  might  build 
up  pressure  and  cause  the  foam  to  pop  off.  However,  NASA 
is  still  studying  this  hypothesized  mechanism  of  foam  loss. 
Experiments  conducted  under  the  Board's  purview  indicate 
that  other  mechanisms  may  be  at  work.  (See  "Foam  Fracture 
Under  Hydrostatic  Pressure"  in  Chapter  3.)  As  discussed  in 
Chapter  3,  the  Board  notes  that  the  persistent  uncertainty 
about  the  causes  of  foam  loss  and  potential  Orbiter  damage 
results  from  a  lack  of  thorough  hazard  analysis  and  engi- 
neering attention. 

The  third  bipod  foam  loss  occurred  on  June  25,  1992,  during 
the  launch  of  Coliiiiihici  on  STS-50,  when  an  approximately 
26-  by  10-inch  piece  separated  from  the  left  bipod  ramp 
area.  Post-mission  inspection  revealed  a  9-inch  by  4.5-inch 
by  0.5-inch  divot  in  the  tile,  the  largest  area  of  tile  damage  in 
Shuttle  history.  The  External  Tank  Project  at  Marshall  Space 
Flight  Center  and  the  Integration  Office  at  Johnson  Space 
Center  cited  separate  In-Flight  Anomalies.  The  Integration 
Ofhce  closed  out  its  In-Flight  Anomaly  two  days  before 
the  next  Might,  STS-46.  by  deeming  damage  to  the  Thermal 
Protection  System  an  "accepted  flight  risk."'-  In  integra- 
tion Hazard  Report  37.  the  Integration  Office  noted  that  the 


impact  damage  was  shallow,  the  tile  loss  was  not  a  result 
of  excessive  aerodynamic  loads,  and  the  External  Tank 
Thermal  Protection  System  failure  was  the  result  of  "inad- 
equate venting.""  The  External  Tank  Project  closed  out  its 
In-Flight  Anomaly  with  the  rationale  that  foam  loss  during 
ascent  was  "not  considered  a  flight  or  safety  issue."'"*  Note 
the  difference  in  how  the  each  program  addressed  the  foam- 
shedding  problem:  While  the  Integration  Office  deemed  it 
an  "accepted  risk,"  the  External  Tank  Project  considered  it 
"not  a  safcty-of-flight  issue."  Hazard  Report  37  would  figure 
in  the  STS-1 13  Flight  Readiness  Review,  where  the  crucial 
decision  was  made  to  continue  flying  with  the  foam-loss 
problem.  This  inconsistency  would  reappear  10  years  later, 
after  bipod  foam-shedding  during  STS-1 12. 

The  fourth  and  fifth  bipod  ramp  foam  loss  events  went  un- 
detected until  the  Board  directed  NASA  to  review  all  avail- 
able imagery  for  other  instances  of  bipod  foam-shedding. 
This  review  of  imagery  from  tracking  cameras,  the  umbili- 
cal well  camera,  and  video  and  still  images  from  flight  crew 
hand  held  cameras  revealed  bipod  foam  loss  on  STS-52  and 
STS-62.  both  of  which  were  flown  by  Cottttiihia.  STS-52, 
launched  on  October  22.  1992,  lost  an  8-  by  4-inch  corner 
of  the  left  bipod  ramp  as  well  as  portions  of  foam  cover- 
ing the  left  jackpad,  a  piece  of  External  Tank  hardware 
that  facilitates  the  Orbiter  attachment  process.  The  STS-52 
post-mission  inspection  noted  a  higher-than-average  290 
hits  on  upper  and  lower  Thermal  Protection  System  tiles, 
16  of  which  were  greater  than  one  inch  in  one  dimension. 
External  Tank  separation  videos  of  STS-62.  launched  on 
March  4,  1994,  revealed  that  a  1-  by  3-inch  piece  of  foam 
in  the  rear  face  of  the  left  bipod  ramp  was  missing,  as  were 
small  pieces  of  foam  around  the  bipod  ramp.  Because  these 
incidents  of  missing  bipod  foam  were  not  detected  until 
after  the  STS-1 07  accident,  no  In-Flight  Anomalies  had 
been  written.  The  Board  concludes  that  NASA's  failure  to 
identify  these  bipod  foam  losses  at  the  time  they  occurred 
means  the  agency  must  examine  the  adequacy  of  its  film 
review,  post-flight  inspection,  and  Program  Requirements 
Control  Board  processes. 

The  sixth  and  final  bipod  ramp  event  before  STS-1 07  oc- 
curred during  STS-1 12  on  October  7,  2002  (see  Figure  6.1- 
3).  At  33  seconds  after  launch,  when  Atlantis  was  at  12,500 
feet  and  traveling  at  Mach  0.75.  ground  cameras  observed 
an  object  traveling  from  the  External  Tank  that  subsequently 
impacted  the  Solid  Rocket  Booster/External  Tank  Attach- 
ment ring  (see  Figure  6.1-4).  After  impact,  the  debris  broke 
into  multiple  pieces  that  fell  along  the  Solid  Rocket  Booster 
exhaust  plume. '"^  Post-mission  inspection  of  the  Solid  Rocket 
Booster  confirmed  damage  to  foam  on  the  forward  face  of 
the  External  Tank  Attachment  ring.  The  impact  was  approxi- 
mately 4  inches  wide  and  3  inches  deep.  Post-External  Tank 
separation  photography  by  the  crew  showed  that  a  4-  by  5- 
by  12-inch  (240  cubic-inch)  corner  section  of  the  left  bipod 
ramp  was  missing,  which  exposed  the  super  lightweight 
ablator  coating  on  the  bipod  housing.  This  missing  chunk  of 
foam  was  believed  to  be  the  debris  that  impacted  the  External 
Tank  Attachment  ring  during  ascent.  The  post-launch  review 
of  photos  and  video  identified  these  debris  events,  but  the 
Mission  Evaluation  Room  logs  and  Mission  Management 
Team  minutes  do  not  reflect  any  discussions  of  them. 
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Figure  6.1-4.  On  STS-112,  the  foam  impacied  fhe  Exfernai  Tank 
Attach  ring  on  the  Solid  Rocket  Booster,  causing  this  tear  in  the 
insulation  on  the  ring. 


STS-113  Flight  Readiness  Review:  A  Pivotal  Decision 

Because  the  bipod  ramp  shedding  on  STS-1 12  was  signifi- 
cant, both  in  size  and  in  the  damage  it  caused,  and  because 
it  occurred  only  two  flights  before  STS-107,  the  Board 
investigated  NASA's  rationale  to  continue  flying.  This  deci- 
sion made  by  the  Program  Requirements  Control  Board  at 
the  STS-1 13  Flight  Readiness  Review  is  among  those  most 
directly  linked  to  the  STS-107  accident.  Had  the  foam  loss 
during  STS-112  been  classified  as  a  more  serious  threat, 
managers  might  have  responded  differently  when  they  heard 
about  the  foam  strike  on  STS-107.  Alternately,  in  the  face 
of  the  increased  risk.  STS-107  might  not  have  flown  at  all. 
However,  at  STS-1 13"s  Flight  Readiness  Review,  managers 
formally  accepted  a  flight  rationale  that  stated  it  was  safe 
to  fly  with  foam  losses.  This  decision  enabled,  and  perhaps 
even  encouraged.  Mission  Management  Team  members  to 
use  similar  reasoning  when  evaluating  whether  the  foam 
strike  on  STS-107  posed  a  safety -of-flight  issue. 

At  the  Program  Requirements  Control  Board  meeting  fol- 
lowing the  return  of  STS-1 12,  the  Intercenter  Photo  Work- 
ing Group  recommended  that  the  loss  of  bipod  foam  be 
classified  as  an  In-Flight  Anomaly.  In  a  meeting  chaired  by 
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'  Issue 

•  Foam  was  lost  on  the  STS- 1 1 2yET-1 1 5  -Y 
bipod  ramp  (•4"  X  5"  X  1 2")  exposing  the 
bipod  housing  Sl_A  closeout 


'  Background 


'  More  than  100  External  Tanks  have  ttown 
with  oniy  3  documented  instances  ot 
significant  foam  loss  on  a  bipod  ramp 


Shuttle  Program  Manager  Ron  Dittemore  and  attended  by 
many  of  the  managers  who  would  be  actively  involved  with 
STS-107,  including  Linda  Ham,  the  Program  Requirements 
Control  Board  ultimately  decided  against  such  classifica- 
tion. Instead,  after  discussions  with  the  Integration  Office 
and  the  External  Tank  Project,  the  Program  Requirements 
Control  Board  Chairman  assigned  an  "action'"  to  the  Ex- 
ternal Tank  Project  to  determine  the  root  cause  of  the  foam 
loss  and  to  propose  corrective  action.  This  was  inconsistent 
with  previous  practice,  in  which  all  other  known  bipod 
foam-shedding  was  designated  as  In-Flight  Anomalies.  The 
Program  Requirements  Control  Board  initially  set  Decem- 
ber 5.  2002,  as  the  date  to  report  back  on  this  action,  even 
though  STS-1 13  was  scheduled  to  launch  on  November  10. 
The  due  date  subsequently  slipped  until  after  the  planned 
launch  and  return  of  STS-107.  The  Space  Shuttle  Program 
decided  to  fly  not  one  but  two  missions  before  resolving  the 
STS-1 12  foam  loss. 

The  Board  wondered  why  NASA  would  treat  the  STS-1 12 
foam  loss  differently  than  all  others.  What  drove  managers 
to  reject  the  recommendation  that  the  foam  loss  be  deemed 
an  In-Flight  Anomaly?  Why  did  they  take  the  unprecedented 
step  of  scheduling  not  one  but  eventually  two  missions  to  fly 
before  the  E.Mernal  Tank  Project  was  to  report  back  on  foam 
losses?  It  seems  that  Shuttle  managers  had  become  condi- 
tioned over  time  to  not  regard  foam  loss  or  debris  as  a  safety- 
of-flight  concern.  As  will  be  discussed  in  Section  6.2,  the 
need  to  adhere  to  the  Node  2  launch  schedule  also  appears 
to  have  influenced  their  decision.  Had  the  STS-1 13  mission 
been  delayed  beyond  early  December  2002,  the  Expedition 
5  crew  on  board  the  Space  Station  would  have  exceeded  its 
1 80-day  on-orbit  limit,  and  the  Node  2  launch  date,  a  major 
management  goal,  would  not  be  met. 

Even  though  the  results  of  the  External  Tank  Project  en- 
gineering analysis  were  not  due  until  after  STS- 113,  the 
foam-shedding  was  reported,  or  "'briefed,"  at  STS-113's 
Flight  Readiness  Review  on  October  31,  2002,  a  meeting 
that  Dittemore  and  Ham  attended.  Two  slides  from  this  brief 
(Figure  6.1-5)  explain  the  disposition  of  bipod  ramp  foam 
loss  on  STS-1 12. 
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'  Rationale  for  Flight 

•  Current  bipod  ramp  closeout  has  not  been  changed 

.   The  Orbiter  has  not  yet  expenenced  "Satety 

of  Flight"  damage  from  loss  of  foam  in 

112  flights  (including  3  known  flights 

with  bipod  ramp  foam  loss) 
-   There  have  been  no  design  I  process  / 

equipment  changes  over  the  last  60 

ETs  (flights) 
.    All  ramp  closeout  wor1<  (including  ET-115  and  ET-116) 

performed  by  expenenced  practitioners  (all  over  20  years 

experience  each) 
.   Ramp  foam  application  involves  craflmanship  in  the  use  of 

validated  application  processess 

•  No  change  in  Inspection  /  Process  control  /  Post  application  handling,  etc 

•  Probability  of  loss  of  ramp  TPS  is  no  higher/no  lower  than  previous  flights 

•  TheET  is  safe  to  fly  with  no  new  concerns  (and  no  added  risk) 


Figure  6.?-5.  These  two  brieFing  slides  are  from  the  STS  113  Flight  Readiness  Review.  The  First  and  third  bullets  on  the  right-hand  slide  are 
incorrect  since  the  design  of  the  bipod  ramp  had  changed  several  times  since  the  flights  listed  on  fhe  slide. 
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This  rationale  is  seriously  flawed.  The  first  and  third  state- 
ments listed  under  "Rationale  for  Flight"  are  incorrect.  Con- 
trary to  the  chart,  which  was  presented  by  Jerry  Smelser,  the 
Program  Manager  for  the  External  Tank  Project,  the  bipod 
ramp  design  had  changed,  as  of  External  Tank-76.  This 
casts  doubt  on  the  implied  argument  that  because  the  design 
had  not  changed,  future  bipod  foam  events  were  unlikely 
to  occur.  Although  the  other  points  may  be  factually  cor- 
rect, they  provide  an  exceptionally  weak  rationale  for  safe 
flight.  The  fact  that  ramp  closeout  work  was  "performed 
by  experienced  practitioners"  or  that  "application  involves 
craftsmanship  in  the  use  of  validated  application  processes" 
in  no  way  decreases  the  chances  of  recurrent  foam  loss.  The 
statement  that  the  "probability  of  loss  of  ramp  Thermal  Pro- 
tection System  is  no  higher/no  lower  than  previous  flights" 
could  be  just  as  accurately  stated  "the  probability  of  bipod 
foam  loss  on  the  next  flight  is  just  as  high  as  it  was  on  previ- 
ous flights."  With  no  engineering  analysis.  Shuttle  managers 
used  past  success  as  a  justification  for  future  flights,  and 
made  no  change  to  the  External  Tank  configurations  planned 
for  STS- 1 1 3.  and.  subsequently,  for  STS- 1 07. 

Along  with  this  chart,  the  NASA  Headquarters  Safety 
Office  presented  a  report  that  estimated  a  99  percent  prob- 
ability of  foam  not  being  shed  from  the  same  area,  even 
though  no  corrective  action  had  been  taken  following  the 
STS-112  foam-shedding."'  The  ostensible  justification  for 
the  99  percent  figure  was  a  calculation  of  the  actual  rate  of 
bipod  loss  over  61  flights.  This  calculation  was  a  sleight- 
of-hand  effort  to  make  the  probability  of  bipod  foam  loss 
appear  low  rather  than  a  serious  grappling  with  the  prob- 
ability of  bipod  ramp  foam  separating.  For  one  thing,  the 
calculation  equates  the  probability  oi  left  and  right  bipod 
loss,  when  right  bipod  loss  has  never  been  observed,  and  the 
amount  of  imagery  available  for  left  and  right  bipod  events 
differs.  The  calculation  also  miscounts  the  actual  number 
of  bipod  ramp  losses  in  two  ways.  First,  by  restricting  the 
sampfe  size  to  flights  between  STS-1 12  and  the  last  known 
bipod  ramp  loss,  it  excludes  known  bipod  ramp  losses  from 
STS-7.  STS-32R,  and  STS-50.  Second,  by  failing  to  project 
the  statistical  rate  of  bipod  loss  across  the  many  missions 
for  which  no  bipod  imagery  is  available,  the  calculation 
assumes  a  "what  you  don't  see  won't  hurt  you"  mentality 
when  in  fact  the  reverse  is  true.  When  the  statistical  rate 
of  bipod  foam  loss  is  projected  across  missions  for  which 
imagery  is  not  available,  and  the  sample  size  is  extended 
to  include  every  mission  from  STS-1  on.  the  probability  of 
bipod  loss  increases  dramatically.  The  Board's  review  after 
STS- 107,  which  included  the  discovery  of  two  additional 
bipod  ramp  losses  that  NASA  had  not  previously  noted, 
concluded  that  bipod  foam  loss  occurred  on  approximately 
10  percent  of  all  missions. 

During  the  brief  at  STS- 1 1 3's  Flight  Readiness  Review,  the 
Associate  Administrator  for  Safety  and  Mission  Assurance 
scrutinized  the  Integration  Hazard  Report  37  conclusion 
that  debris-shedding  was  an  accepted  risk,  as  well  as  the 
External  Tank  Project's  rationale  for  flight.  After  confer- 
ring, STS-1 13  Flight  Readiness  Review  participants  ulti- 
mately agreed  that  foam  shedding  should  be  characterized 
as  an  "accepted  risk"  rather  than  a  "not  a  safety-of-flight" 
issue.  Space  Shuttle  Program  management  accepted  this 


rationale,  and  STS-1 1 3's  Certificate  of  Flight  Readiness 
was  signed. 

The  decision  made  at  the  STS-113  Flight  Readiness  Review 
seemingly  acknowledged  that  the  foam  posed  a  threat  to  the 
Orbiter,  although  the  continuing  disagreement  over  whether 
foam  was  "not  a  safety  of  flight  issue"  versus  an  "accepted 
risk"  demonstrates  how  the  two  terms  became  blurred  over 
time,  clouding  the  precise  conditions  under  which  an  increase 
in  risk  would  be  pemiitted  by  Shuttle  Program  management. 
In  retrospect,  the  bipod  foam  that  caused  a  4-  by  3-inch 
gouge  in  the  foam  on  one  of  Atlantis'  Solid  Rocket  Boosters 
-just  months  before  STS- 107  -  was  a  "strong  signal"  of  po- 
tential future  damage  that  Shuttle  engineers  ignored.  Despite 
the  significant  bipod  foam  loss  on  STS-1 12,  Shuttle  Program 
engineers  made  no  External  Tank  configuration  changes,  no 
moves  to  reduce  the  risk  of  bipod  ramp  shedding  or  poten- 
tial damage  to  the  Orbiter  on  either  of  the  next  two  flights, 
STS-  i  1 3  and  STS- 1 07,  and  did  not  update  Integrated  Hazard 
Report  37.  The  Board  notes  that  although  there  is  a  process 
for  conducting  hazard  analyses  when  the  system  is  designed 
and  a  process  for  re-evaluating  them  when  a  design  is 
changed  or  the  component  is  replaced,  no  process  addresses 
the  need  to  update  a  hazard  analysis  when  anomalies  occur.  A 
stronger  Integration  Office  would  likely  have  insisted  that  In- 
tegrated Hazard  Analysis  37  be  updated.  In  the  course  of  that 
update,  engineers  would  be  forced  to  consider  the  cause  of 
foam-shedding  and  the  effects  of  shedding  on  other  Shuttle 
elements,  including  the  Orbiter  Thermal  Protection  System. 

STS-1 13  launched  at  night,  and  although  it  is  occasionally 
possible  to  image  the  Orbiter  from  light  given  off  by  the 
Solid  Rocket  Motor  plume,  in  this  instance  no  imagery  was 
obtained  and  it  is  possible  that  foam  could  have  been  shed. 

The  acceptance  of  the  rationale  to  fly  cleared  the  way  for 
Coliiiuhia's  launch  and  provided  a  method  for  Mission  man- 
agers to  classify  the  STS- 107  foam  strike  as  a  maintenance 
and  turnaround  concern  rather  than  a  safety-of-flight  issue. 
It  is  significant  that  in  retrospect,  several  NASA  managers 
identified  their  acceptance  of  this  flight  rationale  as  a  seri- 
ous error. 

The  foam-loss  issue  was  considered  so  insignificant  by  some 
Shuttle  Program  engineers  and  managers  that  the  STS- 107 
Flight  Readiness  Review  documents  include  no  discussion 
of  the  still-unresolved  STS-1 12  foam  loss.  According  to  Pro- 
gram rules,  this  discussion  was  not  a  requirement  because 
the  STS-1  12  incident  was  only  identified  as  an  "action,"  not 
an  In-Flight  Anomaly.  However,  because  the  action  was  still 
open,  and  the  date  of  its  resolution  had  slipped,  the  Board  be- 
lieves that  Shuttle  Program  managers  should  have  addressed 
it.  Had  the  foam  issue  been  discussed  in  STS- 107  pre-launch 
meetings.  Mission  managers  may  have  been  more  sensitive 
to  the  foam-shedding,  and  may  have  taken  more  aggressive 
steps  to  determine  the  extent  of  the  damage. 

The  seventh  and  final  known  bipod  ramp  foam  loss  occurred 
on  Januai7  16,  2003,  during  the  launch  of  Columbia  on 
STS- 107.  After  the  Columbia  bipod  loss,  the  Program  Re- 
quirements Control  Board  deemed  the  foam  loss  an  In-Flight 
Anomaly  to  be  dealt  with  by  the  External  Tank  Project. 
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Other  Foam/Debris  Events 

To  better  understand  how  NASA's  treatment  of  debris  strikes 
evolved  over  time,  the  Board  investigated  missions  where 
debris  was  shed  from  locations  other  than  the  External  Tank 
bipod  ramp.  The  number  of  debris  strikes  to  the  Orbiters" 
lower  surface  Thermal  Protection  System  that  resulted  in  tile 
damage  greater  than  one  inch  in  diameter  is  shown  in  Figure 
6.1-6.'^  The  number  of  debris  strikes  may  be  small,  but  a 
single  strike  could  damage  several  tiles  (see  Figure  6. 1-7). 

One  debris  strike  in  particular  foreshadows  the  STS-107 
event.  When  Atlantis  was  launched  on  STS-27R  on  De- 
cember 2,  1988,  the  largest  debris  event  up  to  that  time 
significantly  damaged  the  Orbiter.  Post-launch  analysis  of 
tracking  camera  imagerv  by  the  Intercenter  Photo  Working 
Group  identified  a  large  piece  of  debris  that  struck  the  Ther- 
mal Protection  System  tile  at  approximately  85  seconds  into 
the  flight.  On  Flight  Day  Two,  Mission  Control  asked  the 
flight  crew  to  inspect  Atlantis  with  a  camera  mounted  on  the 
remote  manipulator  arm,  a  robotic  device  that  was  not  in- 
stalled on  Coliinihia  for  STS-107.  Mission  Commander  R.L. 
"Hoot"  Gibson  later  stated  that  Atlantis  "looked  like  it  had 
been  blasted  by  a  shotgun.'""*  Concerned  that  the  Orbiter's 
Thermal  Protection  System  had  been  breached,  Gibson  or- 
dered that  the  video  be  transferred  to  Mission  Control  so  that 
NASA  engineers  could  evaluate  the  damage. 

When  Atlantis  landed,  engineers  were  surprised  by  the  ex- 
tent of  the  damage.  Post-mission  inspections  deemed  it  "the 
most  severe  of  any  mission  yet  flown."'''  The  Orbiter  had 
707  dings,  298  of  which  were  greater  than  an  inch  in  one  di- 
mension. Damage  was  concentrated  outboard  of  a  line  right 
of  the  bipod  attachment  to  the  liquid  oxygen  umbilical  line. 
Even  more  worrisome,  the  debris  had  knocked  off  a  tile,  ex- 
posing the  Orbiter's  skin  to  the  heat  of  re-entry.  Post-flight 
analysis  concluded  that  structural  damage  was  confined  to 
the  exposed  cavity  left  by  the  missing  tile,  which  happened 
to  be  at  the  location  of  a  thick  aluminum  plate  covering  an 
L-band  navigation  antenna.  Were  it  not  for  the  thick  alumi- 


num plate,  Gibson  stated  during  a  presentation  to  the  Board 
that  a  burn-through  may  have  occurred.-" 

The  Board  notes  the  distinctly  different  ways  in  which  the 
STS-27R  and  STS-107  debris  strike  events  were  treated. 
After  the  discovery  of  the  debris  strike  on  Flight  Day  Two 
of  STS-27R.  the  crew  was  immediately  directed  to  inspect 
the  vehicle.  More  severe  thermal  damage  -  perhaps  even  a 
bum-through  -  may  have  occurred  were  it  not  for  the  alu- 
minum plate  at  the  site  of  the  tile  loss.  Fourteen  years  later, 
when  a  debris  strike  was  discovered  on  Flight  Day  Two  of 
STS-107.  Shuttle  Program  management  declined  to  have  the 
crew  inspect  the  Orbiter  for  damage,  declined  to  request  on- 
orbit  imaging,  and  ultimately  discounted  the  possibility  of  a 
burn-through.  In  retrospect,  the  debris  strike  on  STS-27R  is 
a  "strong  signal"  of  the  threat  debris  posed  that  should  have 
been  considered  by  Shuttle  management  when  STS-107  suf- 
fered a  similar  debris  strike.  The  Board  views  the  failure  to 
do  so  as  an  illustration  of  the  lack  of  institutional  memory  in 
the  Space  Shuttle  Program  that  supports  the  Board's  claim, 
discussed  in  Chapter  7.  that  NASA  is  not  functioning  as  a 
learning  organization. 

After  the  STS-27R  damage  was  evaluated  during  a  post- 
flight  inspection,  the  Program  Requirements  Control  Board 
assigned  In-Flight  Anomalies  to  the  Orbiter  and  Solid  Rock- 
et Booster  Projects.  Marshall  Sprayable  Ablator  (MSA- 1) 
material  found  embedded  in  an  insulation  blanket  on  the 
right  Orbital  Maneuvering  System  pod  confirmed  that  the 
ablator  on  the  right  Solid  Rocket  Booster  nose  cap  was  the 
most  likely  source  of  debris.-'  Because  an  improved  ablator 
material  (MSA-2)  would  now  be  used  on  the  Solid  Rocket 
Booster  nose  cap.  the  issue  was  considered  "closed"  by  the 
time  of  the  next  mission's  Flight  Readiness  Review.  The 
Orbiter  Thermal  Protection  System  review  team  concurred 
with  the  u.se  of  the  improved  ablator  without  reservation. 

.An  S  rS-27R  investigation  team  notation  mirrors  a  Colum- 
bia Accident  Investigation  Board  finding.  The  STS-27R 
investigation  noted:  "it  is  observed  that  program  emphasis 


Lower  surface 
damage  clings 
>1  inch 
diameter 


i  STS-26R 

OV-103,  Flight? 


T  Bipod  Ramp  Foam  Loss  Event 


1L...J1IIII1.II1  I 


STS-27R 
OV-104,  Flights 
Cause:  SRB  Ablative 


STS-73 

OV-102,  Flight  18 


STS-87 

OV-102,  Flight  24 

Cause:  ET  Intertank  Foam 


I  -.  lu     ^ — /      I  1^ 

llillibi.i.illiJl.liJiiln.l..Iill.LiLlll^i...ii.H.llUuibllllfa.iJilillh^ 


Space  Shuttle  Mission  Number 


Figure  6.) -6.  T/i/s  chart  shows  the  number  of  dings  greater  thar\  one  inch  in  diameter  on  the  lower  surface  of  the  Orhiter  after  each  mission 
from  STS-6  through  STS-113.  Flights  where  the  bipod  ramp  foam  is  known  to  have  come  off  are  marked  with  a  red  triangle. 


Report    Volume 


■  BUST     2003 


COLUMBIA 

ACCIDENT  INVESTIGATION  BOARD 


MISSION 

DATE 

COMMENTS 

STS-1 

April  12,  1981 

Lots  of  debris  damage.  300  tiles  replaced. 

STS-7 

June  18,  1983 

First  known  left  bipod  ramp  foam  shedding  event. 

STS-27R 

December  2,  1988 

Debris  knocks  off  tile;  structural  damage  and  near  burn  through  results. 

STS-32R 

January  9,  1990 

Second  knov/n  left  bipod  ramp  foam  event. 

STS-35 

December  2,  1990 

First  time  NASA  calls  foam  debris  "safety  of  flight  issue,"  and  "re-use  or  turn- 
around issue." 

STS-42 

January  22,  1992 

First  mission  after  which  the  next  mission  (STS-45)  launched  without  debris  In- 
Flight  Anomaly  closure/resolution. 

STS-45 

March  24,  1992 

Damage  to  wing  RCC  Panel  10-right.  Unexplained  Anomaly,  "most  likely  orbital 
debris." 

STS-50 

June  25,  1992 

Third  known  bipod  ramp  foam  event.  Hazard  Report  37:  an  "accepted  risk." 

STS-52 

October  22,  1992 

Undetected  bipod  romp  foam  loss  (Fourth  bipod  event). 

STS-56 

April  8,  1993 

Acreage  tile  damage  (large  area).  Called  "within  experience  base"  and  consid- 
ered "in  family." 

STS-62 

October  4,  1994 

Undetected  bipod  ramp  foam  loss  (Fifth  bipod  event). 

STS-87 

November  19,  1997 

Damage  to  Orbiter  Thermal  Protection  System  spurs  NASA  to  begin  9  flight 
tests  to  resolve  foam-shedding.  Foam  fix  ineffective.  In-Flight  Anomaly  eventually 
closed  after  STS-1 01  as  "accepted  risk." 

STS-n2 

October  7,  2002 

Sixth  known  left  bipod  ramp  foam  loss.  First  time  major  debris  event  not  assigned 
an  In-Flight  Anomaly.  External  Tank  Project  was  assigned  an  Action.  Not  closed 
out  until  after  STS-1 13  and  STS-1 07 

STS-1 07 

January  16,  2003 

Columbia  launch.  Seventh  known  left  bipod  ramp  foam  loss  event. 

Figure  6.1-7.  The  Board  idenfifiec/  14  flights  fhai  had  significant  Thermal  Protection  System  damage  or  major  foam  loss.  Two  of  the  bipod  foam 
loss  events  had  not  been  detected  by  NASA  prior  to  the  Columbia  Accident  Investigation  Board  requesting  a  review  of  all  launch  images. 


and  attention  to  tile  daniai^e  a.s.se.s.'inient.s  varies  with  severity 
and  that  detailed  records  could  be  augmented  to  ease  trend 
maintenance"  (emphasis  added)."  In  other  words.  Space 
Shuttle  Program  personnel  knew  that  the  monitoring  of 
tile  damage  was  inadequate  and  that  clear  trends  could  be 
more  readily  identified  if  monitoring  was  improved,  but  no 
such  improvements  were  made.  The  Board  also  noted  that 
an  STS-27R  investigation  team  recommendation  correlated 
to  the  Columbia  accident  14  years  later:  "It  is  recommended 
that  the  program  actively  solicit  design  improvements  di- 
rected toward  eliminating  debris  sources  or  minimizing 
damage  potential."-' 

Another  instance  of  non-bipod  foam  damage  occurred  on 
STS-35.  Post-flight  inspections  o^ Columbia  after  STS-S.^i  in 
December  1990.  showed  a  higher-than-average  amount  of 
damage  on  the  Orbiter's  lower  surface.  A  review  of  External 
Tank  separation  film  revealed  approximately  10  areas  of 
missing  foam  on  the  flange  connecting  the  liquid  hydrogen 


tank  to  the  inteilank.  An  In-Flight  Anomaly  was  assigned 
to  the  External  Tank  Project,  which  closed  it  by  stating  that 
there  was  no  increase  in  Orbiter  Thermal  Protection  System 
damage  and  that  it  was  "not  a  .safety-of-flight  concern. "-"* 
The  Board  notes  that  it  was  in  a  discussion  at  the  STS-36 
Flight  Readiness  Review  that  NASA  first  identified  this 
problem  as  a  turnaround  issue."  Per  established  procedures. 
NASA  was  still  designating  foam-loss  events  as  In-Flight 
Anomalies  and  continued  to  make  various  corrective  ac- 
tions, such  as  drilling  more  vent  holes  and  improving  the 
foam  application  process. 

Discovery  was  launched  on  STS-42  on  January  22,  1992.  A 
total  of  159  hits  on  the  Orbiter  Thermal  Protection  System 
were  noted  after  landing.  Two  8-  to  12-inch-diameter  div- 
ots in  the  External  Tank  intertank  area  were  noted  during 
post-External  Tank  separation  photo  evaluation,  and  these 
pieces  of  foam  were  identified  as  the  most  probable  sources 
of  the  damage.  The  External  Tank  Project  was  assigned  an 
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In-Flight  Anomaly,  and  the  incident  was  later  described  as 
an  unexplained  or  isolated  event.  However,  at  later  Flight 
Readiness  Reviews,  the  Marshall  Space  Flight  Center 
briefed  this  as  being  "not  a  safety-of-fiight"  concern.-"  The 
next  flight,  STS-45,  would  be  the  first  mission  launched  be- 
fore the  foam-loss  in-Flight  Anomaly  was  closed. 

On  March  24.  1992,  Atlantis  was  launched  on  STS-45. 
Post-mission  inspection  revealed  exposed  substrate  on  the 
upper  surface  of  right  wing  leading  edge  Reinforced  Car- 
bon-Carbon (RCC)  panel  10  caused  by  two  gouges,  one  1.9 
inches  by  1.6  inches  and  the  other  0.4  inches  by  I  inch.-^ 
Before  the  next  flight,  an  In-Flight  Anomaly  assigned  to 
the  Orbiter  Project  was  closed  as  "unexplained,"  but  "most 
likely  orbital  debris."-**  Despite  this  closure,  the  Safety  and 
Mission  Assurance  Office  expressed  concern  as  late  as  the 
pre-launch  Mission  Management  Team  meeting  two  days 
before  the  launch  of  STS-49.  Nevertheless,  the  mission  was 
cleared  for  launch.  Later  laboratory  tests  identified  pieces 
of  man-made  debris  lodged  in  the  RCC,  including  stainless 
steel,  aluminum,  and  titanium,  but  no  conclusion  was  made 
about  the  source  of  the  debris.  (The  Board  notes  that  this 
indicates  there  were  transport  mechanisms  available  to  de- 
termine the  path  the  debris  took  to  impact  the  wing  leading 
edge.  See  Section  3.4.) 

The  Program  Requirements  Control  Board  also  assigned  the 
External  Tank  Project  an  In-Flight  Anomaly  after  foam  loss 
on  STS-.'56  (Discovery)  and  STS-58  (Cohtmhia).  both  of 
which  were  launched  in  1993.  These  missions  demonstrate 
the  increasingly  casual  ways  in  which  debris  impacts  were 
dispositioned  by  Shuttle  Program  managers.  After  post- 
flight  analysis  determined  that  on  both  missions  the  foam 
had  come  from  the  intertank  and  bipod  jackpad  areas,  the 
rationale  for  closing  the  In-Flight  Anomalies  included  nota- 
tions that  the  External  Tank  foam  debris  was  "in-family,"  or 
within  the  experience  base.-'' 

During  the  launch  of  STS-87  (Columbia)  on  November  19, 
1997,  a  debris  event  focused  NASA's  attention  on  debris- 
shedding  and  damage  to  the  Orbiter  Post-External  Tank 
separation  photography  revealed  a  significant  loss  of  mate- 
rial from  both  thrust  panels,  which  are  fastened  to  the  Solid 
Rocket  Booster  forward  attachment  points  on  the  intertank 
structure.  Post-landing  inspection  of  the  Orbiter  noted  308 
hits,  with  244  on  the  lower  surface  and  109  larger  than  an 
inch.  The  foam  loss  from  the  External  Tank  thrust  panels  was 
suspected  as  the  most  probable  cause  of  the  Orbiter  Thermal 
Protection  System  damage.  Based  on  data  from  post-flight 
inspection  reports,  as  well  as  comparisons  with  statistics 
from  71  similarly  configured  flights,  the  total  number  of 
damage  sites,  and  the  number  of  damage  sites  one  inch  or 
larger,  were  considered  "out-of-family."'"  An  investigation 
was  conducted  to  determine  the  cause  of  the  material  loss 
and  the  actions  required  to  prevent  a  recurrence. 

The  foam  loss  problem  on  STS-87  was  described  as  "pop- 
coming"  because  of  the  numerous  popcorn-size  foam  par- 
ticles that  came  off  the  thrust  panels.  Popcorning  has  always 
occurred,  but  it  began  earlier  than  usual  in  the  launch  of 
STS-87.  The  cause  of  the  earlier-than-normal  popcorning 
(but  not  the  fundamental  cause  of  popcorning)  was  traced 


back  to  a  change  in  foam-blowing  agents  that  caused  pres- 
sure buildups  and  stress  concentrations  within  the  foam.  In 
an  effort  to  reduce  its  use  of  chlorofluorocarbons  (CFCs), 
NASA  had  switched  from  a  CFC-ll  (chlorofluorocarbon) 
blowing  agent  to  an  HCFC-14lb  blowing  agent  beginning 
with  External  Tank-85,  which  was  assigned  to  STS-84.  (The 
change  in  blowing  agent  affected  only  mechanically  applied 
foam.  Foam  that  is  hand  sprayed,  such  as  on  the  bipod  ramp, 
is  still  applied  using  CFC-1 1.) 

The  Program  Requirements  Control  Board  issued  a  Direc- 
tive and  the  External  Tank  Project  was  assigned  an  In-Flight 
Anomaly  to  address  the  intertank  thrust  panel  foam  loss. 
Over  the  course  of  nine  missions,  the  External  Tank  Project 
first  reduced  the  thickness  of  the  foam  on  the  thrust  panels 
to  minimize  the  amount  of  foam  that  could  be  shed;  and, 
due  to  a  misunderstanding  of  what  caused  foam  loss  at 
that  time,  put  vent  holes  in  the  thrust  panel  foam  to  relieve 
trapped  gas  pressure. 

The  In-Flight  Anomaly  remained  open  during  these  changes, 
and  foam  shedding  occurred  on  the  nine  missions  that  tested 
the  corrective  actions.  Following  STS-101,  the  10th  mission 
after  STS-87,  the  Program  Requirements  Control  Board 
concluded  that  foam-shedding  from  the  thrust  panel  had 
been  reduced  to  an  "acceptable  level"  by  sanding  and  vent- 
ing, and  the  In-Flight  Anomaly  was  closed."  The  Orbiter 
Project,  External  Tank  Project,  and  Space  Shuttle  Program 
management  all  accepted  this  rationale  without  question. 
The  Board  notes  that  these  interventions  merely  reduced 
foam-shedding  to  previously  experienced  levels,  which  have 
remained  relatively  constant  over  the  Shuttle's  lifetime. 

Making  the  Orbiter  More  Resistant  To  Debris  Strikes 

If  foam  shedding  could  not  be  prevented  entirely,  what  did 
NASA  do  to  make  the  Thermal  Protection  System  more 
resistant  to  debris  strikes?  A  1990  study  by  Dr.  Elisabeth 
Pate-Cornell  and  Paul  Fishback  attempted  to  quantify  the 
risk  of  a  Thermal  Protection  System  failure  using  probabilis- 
tic analysis.'-  The  data  they  used  included  ( 1 )  the  probability 
that  a  tile  would  become  debonded  by  either  debris  strikes  or 
a  poor  bond,  (2)  the  probability  of  then  losing  adjacent  tiles, 
(3)  depending  on  the  final  size  of  the  failed  area,  the  prob- 
ability of  burn-through,  and  (4)  the  probability  of  failure  of 
a  critical  sub-system  if  burn-through  occurs.  The  study  con- 
cluded that  the  probability  of  losing  an  Orbiter  on  any  given 
mission  due  to  a  failure  of  Thermal  Protection  System  tiles 
was  approximately  one  in  1,000.  Debris-related  problems 
accounted  for  approximately  40  percent  of  the  probability, 
while  60  percent  was  attributable  to  tile  debonding  caused 
by  other  factors.  An  estimated  85  percent  of  the  risk  could 
be  attributed  to  15  percent  of  the  "acreage,"  or  larger  areas 
of  tile,  meaning  that  the  loss  of  any  one  of  a  relatively  small 
number  of  tiles  pose  a  relatively  large  amount  of  risk  to  the 
Orbiter.  In  other  words,  not  all  tiles  are  equal  -  losing  certain 
tiles  is  more  dangerous.  While  the  actual  risk  may  be  differ- 
ent than  that  computed  in  the  1990  study  due  to  the  limited 
amount  of  data  and  the  underiying  simplified  assumptions, 
this  type  of  analysis  offers  insight  that  enables  management 
to  concentrate  their  resources  on  protecting  the  Orbiters' 
critical  areas. 
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Two  years  after  the  conclusion  of  that  study,  NASA  wrote 
to  Pate-Cornel!  and  Fishback  describing  the  importance 
of  their  work,  and  stated  that  it  was  developing  a  long- 
term  effort  to  use  probabilistic  risk  assessment  and  related 
disciplines  to  improve  programmatic  decisions."  Though 
NASA  has  taken  some  measures  to  invest  in  probabilistic 
risk  assessment  as  a  tool,  it  is  the  Board's  view  that  NASA 
has  not  fully  exploited  the  insights  that  Pate-Cornell's  and 
Fishback "s  work  offered.'" 

Impact  Resistant  Tile 

NASA  also  evaluated  the  possibility  of  increasing  Thermal 
Protection  System  tile  resistance  to  debris  hits,  lowering  the 
possibility  of  tile  debonding,  and  reducing  tile  production 
and  maintenance  costs."  Indeed,  tiles  with  a  "tough"  coat- 
ing are  currently  used  on  the  Orbiters.  This  coating,  known 
as  Toughened  Uni-piece  Fibrous  Insulation  (TUFI),  was 
patented  in  1992  and  developed  for  use  on  high-temperature 
rigid  insulation."'  TUFI  is  used  on  a  tile  material  known  as 
Alumina  Enhanced  Thermal  Barrier  (AETB),  and  has  a  de- 
bris impact  resistance  that  is  greater  than  the  current  acreage 
tile's  resistance  by  a  factor  of  approximately  6-20."  At  least 
772  of  these  advanced  tiles  have  been  installed  on  the  Orbit- 
ers' base  heat  shields  and  upper  body  flaps. '**  However,  due 
to  its  higher  thermal  conductivity,  TUFI-coated  AETB  can- 
not be  used  as  a  replacement  for  the  larger  areas  of  tile  cov- 
erage. (Boeing,  Lockheed  Martin  and  NASA  are  developing 
a  lightweight,  impact-resistant,  low-conductivity  tile.'") 
Because  the  impact  requirements  for  these  next-generation 
tiles  do  not  appear  to  be  based  on  resistance  to  specific  (and 
probable)  damage  sources,  it  is  the  Board's  view  that  certifi- 
cation of  the  new  tile  will  not  adequately  address  the  threat 
posed  by  debris. 

Conclusion 

Despite  original  design  requirements  that  the  External  Tank 
not  shed  debris,  and  the  corresponding  design  requirement 
that  the  Orbiter  not  receive  debris  hits  exceeding  a  trivial 
amount  of  force,  debris  has  impacted  the  Shuttle  on  each 
flight.  Over  the  course  of  1 13  missions,  foam-shedding  and 
other  debris  impacts  came  to  be  regarded  more  as  a  turn- 
around or  maintenance  issue,  and  less  as  a  hazard  to  the 
vehicle  and  crew. 

Assessments  of  foam-shedding  and  strikes  were  not  thor- 
oughly substantiated  by  engineering  analysis,  and  the  pro- 
cess for  closing  In-Flight  Anomalies  is  not  well-documented 
and  appears  to  vary.  Shuttle  Program  managers  appear  to 
have  confused  the  notion  of  foam  posing  an  "accepted  risk" 
with  foam  not  being  a  "safety-of-flight  issue."  At  times,  the 
pressure  to  meet  the  flight  schedule  appeared  to  cut  short 
engineering  efforts  to  resolve  the  foam-shedding  problem. 

NASA's  lack  of  understanding  of  foam  properties  and  be- 
havior must  also  be  questioned.  Although  tests  were  con- 
ducted to  develop  and  qualify  foam  for  use  on  the  External 
Tank,  it  appears  there  were  large  gaps  in  NASA's  knowledge 
about  this  complex  and  variable  material.  Recent  testing 
conducted  at  Marshall  Space  Flight  Center  and  under  the 
auspices  of  the  Board  indicate  that  mechanisms  previously 


considered  a  prime  source  of  foam  loss,  cryopumping  and 
cryoingestion,  are  not  feasible  in  the  conditions  experienced 
during  tanking,  launch,  and  ascent.  Also,  dissections  of  foam 
bipod  ramps  on  External  Tanks  yet  to  be  launched  reveal 
subsurface  flaws  and  defects  that  only  now  are  being  discov- 
ered and  identified  as  contributing  to  the  loss  of  foam  from 
the  bipod  ramps. 

While  NASA  properly  designated  key  debris  events  as  In- 
Flight  Anomalies  in  the  past,  more  recent  events  indicate 
that  NASA  engineers  and  management  did  not  appreciate 
the  scope,  or  lack  of  scope,  of  the  Hazard  Reports  involv- 
ing foam  shedding.*"'  Ultimately,  NASA's  hazard  analyses, 
which  were  based  on  reducing  or  eliminating  foam-shed- 
ding, were  not  succeeding.  Shuttle  Program  management 
made  no  adjustments  to  the  analyses  to  recognize  this  fact. 
The  acceptance  of  events  that  are  not  supposed  to  happen 
has  been  described  by  sociologist  Diane  Vaughan  as  the 
"normalization  of  deviance."*"  The  history  of  foam-problem 
decisions  shows  how  NASA  first  began  and  then  continued 
flying  with  foam  losses,  so  that  flying  with  these  deviations 
from  design  specifications  was  viewed  as  normal  and  ac- 
ceptable. Dr.  Richard  Feynman,  a  member  of  the  Presiden- 
tial Commission  on  the  Space  Shuttle  Challenger  Accident, 
discusses  this  phenomena  in  the  context  of  the  Clialleii^er 
accident.  The  parallels  are  .striking: 

The  phenomenon  of  cicreptini>  . . .  flight  seals  that  had 
shown  erosion  and  hlow-hy  in  previous  flights  is  very 
clear.  The  Challenf>er  flight  is  an  excellent  example. 
There  are  several  references  to  flights  that  had  gone  he- 
fore.  The  acceptance  and  success  (yf  these  flights  is  taken 
as  evidence  of  safety.  But  erosions  and  hlow-hy  are  not 
what  the  design  expected.  They  are  warnings  that  some- 
thing is  wrong  . . .  The  0-rings  of  the  Solid  Rocket  Boost- 
ers were  not  designed  to  erode.  Erosion  was  a  clue  that 
something  was  wrong.  Erosion  was  not  something  from 
which  safef}'  can  he  inferred  ...  If  a  reasonable  launch 
schedule  is  to  he  maintained,  engineering  often  cannot 
be  done  fast  enough  to  keep  up  with  the  expectations  of 
origmally  conservative  certification  criteria  designed 
to  guarantee  a  very  safe  vehicle.  In  these  situations, 
subtly,  and  often  with  apparently  logical  arguments,  the 
criteria  are  altered  so  that  flights  may  still  be  certified  in 
time.  They  thereft)re  fly  in  a  relatively  iin.safe  condition, 
with  a  chance  of  failure  of  the  order  of  a  percent  (it  is 
difficult  to  he  more  accurate).'*^ 

Findings 

F6. 1  -1  NASA  has  not  followed  its  own  rules  and  require- 
ments on  foam-shedding.  Although  the  agency 
continuously  worked  on  the  foam-shedding 
problem,  the  debris  impact  requirements  have  not 
been  met  on  any  mission. 

F6. 1-2  Foam-shedding,  which  had  initially  raised  seri- 
ous safety  concerns,  evolved  into  "in-family"  or 
"no  safety-of-flight"  events  or  were  deemed  an 
"accepted  risk." 

F6. 1-3  Five  of  the  seven  bipod  ramp  events  occurred 
on  missions  flown  by  Columbia,  a  seemingly 
high  number.  This  observation  is  likely  due  to 
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Cohiinhia  having  been  equipped  with  umbilical 
cameras  earlier  than  other  Orbiters. 

F6. 1  -4  There  is  lack  of  effective  processes  for  feedback 
or  integration  among  project  elements  in  the  reso- 
lution of  in-Flight  Anomalies. 

F6. 1  -5  Foam  bipod  debris-shedding  incidents  on  STS-52 
and  STS-62  were  undetected  at  the  time  they  oc- 
curred, and  were  not  discovered  until  the  Board 
directed  NASA  to  examine  External  Tank  separa- 
tion images  more  closely. 

F6. 1-6  Foam  bipod  debris-shedding  events  were  clas- 
sified as  In-Flight  Anomalies  up  until  STS-II2, 
which  was  the  first  known  bipod  foam-shedding 
event  not  classified  as  an  In-Flight  Anomaly. 

F6. 1-7  The  STS-112  assignment  for  the  External  Tank 
Project  to  "identify  the  cause  and  corrective  ac- 
tion of  the  bipod  ramp  foam  loss  event"  was  not 
due  until  after  the  planned  launch  of  STS-113. 
and  then  slipped  to  after  the  launch  of  STS- 107. 

F6. 1-8  No  External  Tank  configuration  changes  were 
made  after  the  bipod  foam  loss  on  STS-1 12. 

F6. 1  -9  Although  it  is  sometimes  possible  to  obtain  imag- 
ery of  night  launches  because  of  light  provided  by 
the  Solid  Rcx'ket  Motor  plume,  no  imagery  was 
obtained  for  STS- 113. 

F6. 1-10  NASA  failed  to  adequately  perform  trend  analy- 
sis on  foam  losses.  This  greatly  hampered  the 
agency's  ability  to  make  informed  decisions 
about  foam  losses. 

F6. 1  - 1 1  Despite  the  constant  shedding  of  foam,  the  Shut- 
tle Program  did  little  to  harden  the  Orbiter  against 
foam  impacts  through  upgrades  to  the  Thermal 
Protection  System.  Without  impact  resistance 
and  strength  requirements  that  are  calibrated  to 
the  energy  of  debris  likely  to  impact  the  Orbiter, 
certification  of  new  Thermal  Protection  System 
tile  will  not  adequately  address  the  threat  posed 
by  debris. 

Reconfimendations: 

•  None 

6.2    Schedule  Pressure 

Countdown  to  Space  Station  "Core  Complete:"  A 
Workforce  Under  Pressure 

During  the  course  of  this  investigation,  the  Board  received 
several  unsolicited  comments  from  NASA  personnel  regard- 
ing pressure  to  meet  a  schedule.  These  comments  all  con- 
cerned a  date,  more  than  a  year  after  the  launch  of  Coliimhia. 
that  seemed  etched  in  stone:  February  19,  2004,  the  sched- 
uled launch  date  of  STS- 1 20.  This  flight  was  a  milestone  in 
the  minds  of  NASA  management  since  it  would  carry  a  sec- 
tion of  the  International  Space  Station  called  "Node  2."  This 
would  configure  the  International  Space  Station  to  its  "U.S. 
Core  Complete"  status. 

At  first  glance,  the  Core  Complete  configuration  date 
seemed  noteworthy  but  unrelated  to  the  Coliimhia  accident. 
However,  as  the  investigation  continued,  it  became  apparent 


that  the  complexity  and  political  mandates  surrounding  the 
International  Space  Station  Program,  as  well  as  Shuttle  Pro- 
gram management's  responses  to  them,  resulted  in  pressure 
to  meet  an  increasingly  ambitious  launch  schedule. 

In  mid-2001.  NASA  adopted  plans  to  make  the  over-budget 
and  behind-schedule  International  Space  Station  credible  to 
the  White  House  and  Congress.  The  Space  Station  Program 
and  NASA  were  on  probation,  and  had  to  prove  they  could 
meet  schedules  and  budgets.  The  plan  to  regain  credibility  fo- 
cused on  the  Februarv'  19,  2004,  date  for  the  launch  of  Node 
2  and  the  resultant  Core  Complete  status.  If  this  goal  was  not 
met.  NASA  would  risk  losing  support  from  the  White  House 
and  Congress  for  subsequent  Space  Station  growth. 

By  the  late  summer  of  2002,  a  variety  of  problems  caused 
Space  Station  assembly  work  and  Shuttle  flights  to  slip  be- 
yond their  target  dates.  With  the  Node  2  launch  endpoint 
fixed,  these  delays  caused  the  schedule  to  become  ever  more 
compressed. 

Meeting  U.S.  Core  Complete  by  February  19,  2004,  would 
require  preparing  and  launching  10  flights  in  less  than  16 
months.  With  the  focus  on  retaining  support  for  the  Space 
Station  program,  little  attention  was  paid  to  the  effects  the 
aggressive  Node  2  launch  date  would  have  on  the  Shuttle 
Program.  After  years  of  downsizing  and  budget  cuts  (Chapter 
5),  this  mandate  and  events  in  the  months  leading  up  to  STS- 
107  intrtKluced  elements  of  risk  to  the  Program.  Coliimhia 
and  the  STS- 1 07  crew,  who  had  seen  numerous  launch  slips 
due  to  missions  that  were  deemed  higher  priorities,  were 
further  affected  by  the  mandatory  Core  Complete  date.  The 
high-pressure  environments  created  by  NASA  Headquarters 
unquestionably  affected  Coliimhia,  even  though  it  was  not 
flying  to  the  International  Space  Station. 

February  19,  2004  -  "A  Line  in  the  Sand" 

Schedules  are  essential  tools  that  help  large  organizations 
effectively  manage  their  resources.  Aggressive  schedules  by 
themselves  are  often  a  sign  of  a  healthy  institution.  How- 
ever, other  institutional  goals,  such  as  safety,  sometimes 
compete  with  schedules,  so  the  effects  of  schedule  pres- 
sure in  an  organization  must  be  carefully  monitored.  The 
Board  posed  the  question:  Was  there  undue  pressure  to  nail 
the  Node  2  launch  date  to  the  February  19.  2004,  signpost? 
The  management  and  workforce  of  the  Shuttle  and  Space 
Station  programs  each  answered  the  question  differently. 
Various  members  of  NASA  upper  management  gave  a  defi- 
nite "no."  In  contrast,  the  workforce  within  both  programs 
thought  there  was  considerable  management  focus  on  Node 
2  and  resulting  pressure  to  hold  firm  to  that  launch  date,  and 
individuals  were  becoming  concerned  that  safety  might  be 
compromised.  The  weight  of  evidence  supports  the  work- 
force view. 

Employees  attributed  the  Node  2  launch  date  to  the  new 
Administrator,  Sean  O'Keefe,  who  was  appointed  to  execute 
a  Space  Station  management  plan  he  had  proposed  as  Dep- 
uty Director  of  the  White  House  Office  of  Management  and 
Budget.  They  understood  the  scrutiny  that  NASA,  the  new 
Administrator,  and  the  Space  Station  Program  were  under. 
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but  now  it  seemed  to  some  that  budget  and  schedule  were  of 
paramount  concern.  As  one  employee  reflected: 

I  i;iiess  niY  frustration  was  ...I  know  the  importance  of 
sl]owint>  that  yon  . . .  inanai^e  your  hiulget  and  that 's  an 
important  impression  to  make  to  Congress  so  you  can 
contitiue  the  future  of  the  agency,  hut  to  a  lot  of  people, 
Fehruary  19th  just  seemed  like  an  arbitrary  date  ... 
It  doesn  't  make  sen.se  to  me  why  at  all  costs  we  were 
marching  to  this  date. 

The  importance  of  this  date  was  stressed  from  the  very  top. 
The  Space  Shuttle  and  Space  Station  Program  Managers 
briefed  the  new  NASA  Administrator  monthly  on  the  status 
of  their  programs,  and  a  significant  part  of  those  briefings 
was  the  days  of  margin  remaining  in  the  schedule  to  the 
launch  of  Node  2  -  still  well  over  a  year  away.  The  Node  2 
schedule  margin  typically  accounted  for  more  than  half  of 
the  briefing  slides. 

Figure  6.2-1  is  one  of  the  charts  presented  by  the  Shuttle 
Program  Manager  to  the  NASA  Administrator  in  December 
2002.  The  chart  shows  how  the  days  of  margin  in  the  exist- 
ing schedule  were  being  managed  to  meet  the  requirement 


of  a  Node  2  launch  on  the  prescribed  date.  The  triangles 
are  events  that  affected  the  schedule  (such  as  the  slip  of  a 
Russian  Soyuz  flight).  The  squares  indicate  action  taken 
by  management  to  regain  the  lost  time  (such  as  authorizing 
work  over  the  2002  winter  holidays). 

Figure  6.2-2  shows  a  slide  from  the  International  Space  Sta- 
tion Program  Manager's  portion  of  the  briefing.  It  indicates 
that  International  Space  Station  Program  management  was 
also  taking  actions  to  regain  margin.  Over  the  months,  the 
extent  of  some  testing  at  Kennedy  was  reduced,  the  number 
of  tasks  done  in  parallel  was  increased,  and  a  third  shift  of 
workers  would  be  added  in  2003  to  accomplish  the  process- 
ing. These  charts  illustrate  that  both  the  Space  Shuttle  and 
Space  Station  Programs  were  being  managed  to  a  particular 
launch  date  -  February  19,  2004.  Days  of  margin  in  that 
schedule  were  one  of  the  principle  metrics  by  which  both 
programs  came  to  be  judged. 

NASA  Headquarters  stressed  the  importance  of  this  date  in 
other  ways.  A  screen  saver  (see  Figure  6.2-3)  was  mailed 
to  managers  in  NASA's  human  spaceflight  program  that 
depicted  a  clock  counting  down  to  February  19,  2004  -  U.S. 
Core  Complete. 


flS 


SSP  Schedule  Reserve 


c 

03 


SSP  Core  Complete  35 

Sctiedule  hAargin  -  PdSt  28 


A    A 


t 


A 
A 

s 

A 

A 
A 


Late  OMM  start  (Node  2  was  on 
OV-103) 

Moved  Node2toOV-105 
Accommodate  4S  slip  1  week 
ISS  adding  wrist  joint  on  UF2 
Moved  OV-104  Str  Ins,  to  9*^  At 


Engine  Flowliner  cracks 

Reduced  Structural  Inspection 
Requirements 

Accommodate  4S  slip 

02  flexline  leak/  SRMS  damage 

Defer  reqmts;  apply  reserve 


D  Management  action 
A  Schedule  impact  event 


SSP  Core  Complete  Schedule  Threats 

STS-120/Node  2  launch  subject  to  45  days  of  schedule  risk 
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Management  Options 

'  USA  commit  holiday/weekend  reserves  and 
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hold  schedule  (Note:  3'"  shift  not  yet  included) 
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Figure  6.2-1.  This  chart  was  presented  by  the  Space  Shuttle  Program  Manager  to  the  NASA  Administrator  in  December  2002.  It  illustrates 
how  the  schedule  was  being  managed  to  meet  the  Node  2  launch  date  of  February  J9,  2004. 
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While  employees  found  this  amusing  because  they  saw  it  as 
a  date  that  could  not  be  met,  it  also  reinforced  the  message 
that  NASA  Headquarters  was  focused  on  and  promoting  the 
achievement  of  that  date.  This  schedule  was  on  the  minds  of 
the  Shuttle  managers  in  the  months  leading  up  to  STS-i07. 

The  Background:  Schedule  Complexity  and 
Compression 

In  2001,  the  International  Space  Station  Cost  and  Manage- 
ment Evaluation  Task  Force  report  recommended,  as  a 
cost-saving  measure,  a  limit  of  four  Shuttle  flights  to  the  In- 
ternational Space  Station  per  year.  To  meet  this  requirement, 
managers  began  adjusting  the  Shuttle  and  Station  manifests 
to  "get  back  in  the  budget  box."  They  reananged  Station 
assembly  sequences,  moving  some  elements  forward  and 
taking  others  out.  When  all  was  said  and  done,  the  launch 
of  STS-120.  which  would  carry  Node  2  to  the  International 
Space  Station,  fell  on  February  19.  2004. 

The  Core  Complete  date  simply  emerged  from  this  plan- 
ning effort  in  2001.  By  all  accounts,  it  was  a  realistic  and 
achievable  date  when  first  approved.  At  the  time  there  was 
more  concern  that  four  Shuttle  flights  a  year  would  limit  the 
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Figure  6.2-3.  NASA  Headquarters  distributed  to  NASA  employees 
this  computer  Screensaver  counting  down  to  February  19,  2004. 


capability  to  can^  supplies  to  and  from  the  Space  Station, 
to  rotate  its  crew,  and  to  transport  remaining  Space  Station 
segments  and  equipment.  Still,  managers  felt  it  was  a  rea- 
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/SS  Core  Complete  Schedule  Threat 

•  0/D  KSC  date  will  likely  slip  another  2  months 

•  Alenia  financial  concerns 

•  KSC  test  problems 

•  Node  ships  on  time  but  work  or  paper  is  not  complete  0-1 
month  impact 

•  Traveled  work  "as-built"  reconciliation 
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/SS  Management  Options 

'  Hold  ASI  to  delivery  schedule 

•  Management  discussions  with  ASI  and  ESA 
•  Reduce  testing  scope 
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Figure  6.2-2.  At  the  same  December  2002  meefing,  the  International  Space  Station  Program  Manager  presented  this  slide,  showing  the 
actions  being  taken  to  regain  margin  in  the  schedule.  Note  that  the  yellow  triangles  reflect  zero  days  remaining  margin. 
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sonable  goal  and  assumed  that  if  circumstances  wairanted  a 
slip  of  that  date,  it  would  be  granted. 

Shuttle  and  Station  managers  worked  diligently  to  meet  the 
schedule.  Events  gradually  ate  away  at  the  schedule  margin. 
Unlike  the  "old  days"  before  the  Station,  the  Station/Shuttle 
partnership  created  problems  that  had  a  ripple  effect  on 
both  programs"  manifests.  As  one  employee  described  it, 
"the  serial  nature"  of  having  to  fly  Space  Station  assembly 
missions  in  a  specific  order  made  staying  on  schedule  more 
challenging.  Before  the  Space  Station,  if  a  Shuttle  flight  had 
to  slip,  it  would;  other  missions  that  had  originally  followed 
it  would  be  launched  in  the  meantime.  Missions  could  be 
flown  in  any  sequence.  Now  the  manifests  were  a  delicate 
balancing  act.  Missions  had  to  be  flown  in  a  certain  order 
and  were  constrained  by  the  availability  of  the  launch  site, 
the  Russian  Soyuz  and  Progress  schedules,  and  a  myriad  of 
other  processes.  As  a  result,  employees  stated  they  were  now 
experiencing  a  new  kind  of  pressure.  Any  necessary  change 
they  made  on  one  mission  was  now  impacting  future  launch 
dates.  They  had  a  sense  of  being  "under  the  gun." 

Shuttle  and  Station  prograin  personnel  ended  up  with  mani- 
fests that  one  employee  described  as  "changing,  changing, 
changing"  all  the  time.  One  of  the  biggest  issues  they  faced 
entering  2002  was  "up  mass,"  the  amount  of  cargo  the  Shut- 
tle can  carry  to  the  Station.  Up  mass  was  not  a  new  problem, 
but  when  the  Shuttle  flight  rate  was  reduced  to  four  per  year, 
up  mass  became  critical.  Working  groups  were  actively 
evaluating  options  in  the  summer  of  2002  and  bartering  to 
get  each  flight  to  function  as  expected. 

Sometimes  the  up  mass  being  traded  was  actual  Space  Sta- 
tion crew  members.  A  crew  rotation  planned  for  STS-118 
was  moved  to  a  later  flight  because  STS- 1 1 8  was  needed  for 
other  cargo.  This  resulted  in  an  increase  of  crew  duration  on 
the  Space  Station,  which  was  creeping  past  the  1 80-day  limit 
agreed  to  by  the  astronaut  office,  flight  surgeons,  and  Space 
Station  international  partners.  A  space  station  worker  de- 
scribed how  this  one  change  created  many  other  problems, 
and  added:  ". . .  we  had  a  train  wreck  coiiiiiif^  ..."  Future  on- 
orbit  crew  time  was  being  projected  at  205  days  or  longer  to 
maintain  the  assembly  sequence  and  meet  the  schedule. 

By  .July  2002,  the  Shuttle  and  Space  Station  Programs  were 
facing  a  schedule  with  very  little  margin.  Two  setbacks  oc- 
curred when  technical  problems  were  found  during  routine 
maintenance  on  Discovery.  STS- 1 07  was  four  weeks  away 
from  launch  at  the  time,  but  the  problems  grounded  the 
entire  Shuttle  fleet.  The  longer  the  fleet  was  grounded,  the 
more  schedule  margin  was  lost,  which  further  compounded 
the  complexity  of  the  intertwined  Shuttle  and  Station  sched- 
ules. As  one  worker  described  the  situation: 

...a  one-week  hit  on  a  particular  launch  can  .start  a 
.steam  roll  effect  includinii  all  [the]  constraints  and 
by  the  time  you  f>et  out  of  here,  that  one-week  slip  has 
turned  into  a  couple  of  months. 

In  August  2002,  the  Shuttle  Program  realized  it  would  be 
unable  to  meet  the  Space  Station  schedule  with  the  avail- 
able Shuttles.  Columbia  had  never  been  outfitted  to  make 


a  Space  Station  flight,  so  the  other  three  Orbiters  flew  the 
Station  missions.  But  Discovery  was  in  its  Orbiter  Mainte- 
nance Down  Period,  and  would  not  be  available  for  another 
17  months.  All  Space  Station  flights  until  then  would  have 
to  be  made  by  Atlantis  and  Endeavour.  As  managers  looked 
ahead  to  2003,  they  saw  that  after  STS- 107,  these  two  Orbit- 
ers would  have  to  alternate  flying  five  consecutive  missions, 
STS-II4  through  STS-118.  To  alleviate  this  pressure,  and 
regain  .schedule  margin,  Shuttle  Program  managers  elected 
to  modify  Columbia  to  enable  it  to  fly  Space  Station  mis- 
sions. Those  modifications  were  to  take  place  immediately 
after  STS- 107  so  that  Columbia  would  be  ready  to  fly  its  first 
Space  Station  mission  eight  months  later.  This  decision  put 
Columbia  directly  in  the  path  of  Core  Complete. 

As  the  autumn  of  2002  began,  both  the  Space  Shuttle  and 
Space  Station  Programs  began  to  use  what  some  employ- 
ees termed  "tricks"  to  regain  schedule  margin.  Employees 
expressed  concent  that  their  ability  to  gain  schedule  margin 
using  existing  measures  was  waning. 

In  September  2002,  it  was  clear  to  Space  Shuttle  and  Space 
Station  Program  managers  that  they  were  not  going  to  meet 
the  schedule  as  it  was  laid  out.  The  two  Programs  proposed  a 
new  set  of  launch  dates,  documented  in  an  e-mail  (right)  that 
included  moving  STS- 1 20,  the  Node  2  flight,  to  mid-March 
2004.  (Note  that  the  first  paragraph  ends  with  "...  the  JOA 
[U.S.  Core  Cortiplete.  Node  2])aunch  remains  2/19/04.") 

The.se  launch  date  changes  made  it  possible  to  meet  the 
early  part  of  the  schedule,  but  compressed  the  late  2003/ 
early  2004  schedule  even  further.  This  did  not  make  sense 
to  many  in  the  program.  One  described  the  system  as  at  "an 
uncomfortable  point. "  noted  having  to  go  to  great  lengths  to 
reduce  vehicle-processing  time  at  Kennedy,  and  added: 

...  /  don't  know  what  Coni>ress  communicated  to 
O'Keefe.  I  don't  really  understand  the  criticality  of 
February  1 9th.  that  if  we  didn  't  make  that  date,  did  that 
mean  the  end  of  NASA'.'  I  don't  know  ...  /  would  like  to 
think  that  the  technical  i.ssues  and  safely  resolving  the 
technical  i.ssues  can  take  priority  over  any  budget  issue 
or  .scheduling  issue. 

When  the  Shuttle  fleet  was  cleared  to  return  to  flight,  atten- 
tion turned  to  .STS- 1 12,  STS- 1 13.  and  STS- 107,  set  for  Oc- 
tober, November,  and  January.  Workers  were  uncomfortable 
with  the  rapid  sequence  of  flights. 

The  thing  that  was  beginning  to  concern  me  ...  is  I 
wasn  't  convinced  that  people  were  being  given  enough 
time  to  work  the  problems  correctly. 

The  problems  that  had  grounded  the  fleet  had  been  handled 
well,  but  the  program  nevertheless  lost  the  rest  of  its  margin. 
As  the  pressure  to  keep  to  the  Node  2  schedule  continued, 
some  were  concerned  that  this  might  influence  the  future 
handling  of  problems.  One  worker  expressed  the  concern: 

...  and  I  have  to  think  that  subconsciously  that  even 
though  you  don't  want  it  to  affect  decisi(m-making.  it 
probably  does. 
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Original  Message 

From:  THOMAS,  DAWN  A.  (JSC-OC)  (NASA) 

Sent:  Friday,  September  20,  2002  7:10  PM 

To:  Tlowers,  David';  "Horvath,  Greg';  'O'Fallon,  Lee';  Van  Scyoc,  Neal';  'Gouti,  Tom';  'Hagen,  Ray';  "Kennedy,  John'; 

Thornburg,  Richard';  "Garl,  Judy';  'Dodds,  Joel';  'Janes,  Lou  Ann';  'Breen,  Brian';  'Deheck-Stokes,  Kristina'; 
'Narita,  Kaneaki  (NASDA)';  "Patrick,  Penny  O';  'Michael  Rasmussen  (E-mail)';  DL  FPWG;  'Hughes,  Michael  G'; 
'Bennett,  Patty';  "MasazumI,  Miyake';  'Mayumi  Matsuura';  NORIEGA,  CARLOS  I.  (JSC-CB)  (NASA);  BARCLOvY, 
DINA  E.  (JSC-DX)  (NASA);  MEARS,  AARON  (JSC-XA)  (HS);  BROWN,  WILLIAM  C.  (JSC-DT)  (NASA);  DUMESNIL, 
DEANNA  T  (JSC-OC)  (USA);  MOORE,  NATHAN  (JSC-REMOTE);  MONTALBANO,  JOEL  R.  (JSC-DA8)  (NASA); 
MOORE,  PATRICIA  (PATTI)  (JSC-DA8)  (NASA);  SANCHEZ,  HUMBERTO  (JSC-DA8)  (NASA) 

Subject:  FPWG  status  -  9/20/02  OA/MA  mgrs  mtg  results 

The  ISS  and  SSP  Program  Managers  have  agreed  to  proceed  with  the  crew  rotation  change  and  the 
following  date  changes:  12A  launch  to  5/23/03,  12A.1  launch  to  7/24/03,  13A  launch  to  10/2/03,  and 
13A.1  launch  to  NET  11/13/03.  Please  note  that  10A  launch  remains  2/19/04. 

The  ISS  SSCN  that  requests  evaluation  of  these  changes  will  be  released  Monday  morning  after  the 
NASA/Russian  bilateral  Requirements  and  Increment  Planning  videocon.  It  will  contain  the  following: 

•  Increments  8  and  9  redefinition  -  this  includes  baseline  of  ULF2  into  the  tactical  timeframe  as  the 
new  return  flight  for  Expedition  9 

•  Crew  size  changes  for  7S,  13A.1,  15A,  and  10A 

•  Shuttle  date  changes  as  listed  above 

•  Russian  date  changes  for  CY2003  that  were  removed  from  SSCN  6872  (IIP  launch/1  OP  undock 
and  subsequent) 

•  CY2004  Russian  data  if  available  Monday  morning 

•  Duration  changes  for  1 2A  and  1 5A 

•  Docking  altitude  update  for  10A,  along  with  "NET"  TBR  closure. 

The  evaluation  due  date  is  10/2/02.  Board/meeting  dates  are  as  follows:  MIOCB  status  - 10/3/02; 
comment  dispositioning  - 10/3/02  FPWG  (meeting  date/time  under  review);  OA/MA  Program  Man- 
agers status  -  10/4/02;  SSPCB  and  JPRCB  - 10/8/02;  MMIOCB  status  (under  review)  and  SSCB 
-10/10/02. 

The  1 3A.  1  date  is  indicated  as  "NET"  (No  Earlier  Than)  since  SSP  ability  to  meet  that  launch  date  is 
under  review  due  to  the  processing  flow  requirements. 

There  is  no  longer  a  backup  option  to  move  ULF2  to  OV-105:  due  to  vehicle  processing  requirements, 
there  is  no  launch  opportunity  on  OV-105  past  May  2004  until  after  OMM. 

The  Program  Managers  have  asked  for  preparation  of  a  backup  plan  in  case  of  a  schedule  slip  of 
ULF2.  In  order  to  accomplish  this,  the  projected  ISS  upmass  capability  shortfall  will  be  calculated  as 
if  ULF2  launch  were  10/7/04,  and  a  recommendation  made  for  addressing  the  resulting  shortfall  and 
increment  durations.  Some  methods  to  be  assessed:  manifest  restructuring,  fallback  moves  of  rota- 
tion flight  launch  dates,  LON  (Launch  on  Need)  flight  on  4/29/04. 


llSS=lntemaHonal  Space  Station,  SSP=Space  Shuttle  Program,  NET=no  earlier  than,  SSCN=Space  Station  Change  No- 
tice,  CY=Co/endar  Year,  T6R=To  Be  Revised  for  Reviewed),  MIOCB=Mission  Integration  and  Operations  Control  Board, 
FPWC=Flight  Planning  Working  Group,  OA/MA=Space  Station  Office  Symbol/ShuHle  Program  Office  Symbol,  SSPC6=Space 
Station  Program  Control  Board,  JPRCB=Space  Shuttle/Space  Station  Joint  Program  Requirements  Control  Board, 
MMIOCB= Multi-Lateral  Mission  Integration  and  Operations  Control  Board,  SSCB=Space  Station  Control  Board,  ULF2=U.S. 
Logistics  Flight  2,  OMM=Orbiter  Major  Modification,  OV-105=Endeavour] 


This  was  the  environment  tor  October  and  November  of  The  Operations  Tempo  Follov/Ing  STS-107 

2002.  During  this  time,  a  bipod  foam  event  occurred  on  STS- 

112.  For  the  first  time  in  the  history  of  the  Shuttle  Program.  After  STS-107,  the  tempo  was  only  going  to  increase.  The 

the  Program  Requirements  Control  Board  chose  to  classify  vehicle  processing  schedules,  training  schedules,  and  mission 

that  bipod  foam  loss  as  an  "action"  rather  than  a  more  seri-  control  flight  staffing  assignments  were  all  overburdened. 

ous  In-Flight  Anomaly.  At  the  STS-113  Flight  Readiness 

Review,  managers  accepted  with  little  question  the  rationale  The  vehicle-processing  schedule  for  flights  from  February 

that  it  was  safe  to  fly  with  the  known  foam  pr(^blem.  2003,  through  February  2004,  was  optimistic.  The  schedule 

Report    Volume     I  A  u  t3  u  s  t     2D03  1    35 


COLUMBIA 

ACCIDENT  iNVESTIGATiaN  BOARD 


could  not  be  met  with  only  two  shifts  of  workers  per  day.  In 
late  2002,  NASA  Headquarters  approved  plans  to  hire  a  third 
shift.  There  were  four  Shuttle  launches  to  the  Space  Station 
scheduled  in  the  five  months  from  October  2003.  through  the 
launch  of  Node  2  in  February  2004.  To  put  this  in  perspec- 
tive, the  launch  rate  in  1985,  for  which  NASA  was  criticized 
by  the  Rogers  Commission,  was  nine  flights  in  12  months 
-  and  that  was  accomplished  with  four  Orbiters  and  a  mani- 
fest that  was  not  complicated  by  Space  Station  assembly. 

Endeavour  was  the  Orbiter  on  the  critical  path.  Figure  6.2-4 
shows  the  schedule  margin  for  STS-ll.'i,  STS-117,  and 
STS-120  (Node  2).  To  preserve  the  margin  going  into  2003, 
the  vehicle  processing  team  would  be  required  to  work  the 
late  2002-early  2003^  winter  holidays.  The  third  shift  of 
workers  at  Kennedy  would  be  available  in  March  2003, 
and  would  buy  eight  more  days  of  margin  for  STS-1 17  and 
STS-12().  The  workforce  would  likely  have  to  work  on  the 
2003  winter  holidays  to  meet  the  Node  2  date. 

Figure  6.2-5  shows  the  margin  for  each  vehicle  {Discovery, 
OV-103,  was  in  extended  maintenance).  The  large  boxes 
indicate  the  "margin  to  critical  path"  (to  Node  2  launch 
date).  The  three  smaller  boxes  underneath  indicate  (from 


left  to  right)  vehicle  processing  margin,  holiday  margin,  and 
Dryden  margin.  The  vehicle  processing  margin  indicates 
how  many  days  there  are  in  addition  to  the  days  required  for 
that  mission's  vehicle  processing.  Endeavour  (OV-105)  had 
zero  days  of  margin  for  the  processing  flows  for  STS-1 15, 
STS-1 17,  and  STS-120.  The  holiday  margin  is  the  number 
of  days  that  could  be  gained  by  working  holidays.  The 
Dryden  margin  is  the  six  days  that  are  always  reserved  to 
accommodate  an  Orbiter  landing  at  Edwards  Air  Force  Base 
in  California  and  having  to  be  ferried  to  Kennedy,  if  the 
Orbiter  landed  at  Kennedy,  those  six  days  would  automati- 
cally be  regained.  Note  that  the  Dryden  margin  had  already 
been  sun-endered  in  the  STS-l  14  and  STS-1 15  schedules.  If 
bad  weather  at  Kennedy  forced  those  two  flights  to  land  at 
Edwards,  the  schedule  would  be  directly  affected. 

The  clear  message  in  these  charts  is  that  any  technical  prob- 
lem that  resulted  in  a  slip  to  one  launch  would  now  directly 
affect  the  Node  2  launch. 

The  lack  of  housing  for  the  Orbiters  was  becoming  a  fac- 
tor as  well.  Prior  to  launch,  an  Orbiter  can  be  placed  in  an 
Orbiter  Processing  Facility,  the  Vehicle  Assembly  Building, 
or  on  one  of  the  two  Shuttle  launch  pads.  Maintenance  and 
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SSP  Core  Complete  Schedule  Threats 

STS-120/Node  2  launch  subject  to  45  days  of  schedule  risk 

•  Space  Shuttle  technical  problems 

•  Station  on-orbit  technical  problems/mission  requirements  impact 

•  Range  launch  cutouts 

•  Weather  delays 

•  Soyuz  and  Progress  conflicts 


Management  Options 

•  USA  commit  holiday/weekend  reserves  and 
apply  additional  resources  to  hold  schedule 

1.  Flex  3" shift  avail— Mar  03 

2.  LCC  3" shift  avail— Apr  03 

•  HQ  mitigate  Range  Cutout 

•  HQ  and  ISS  mitigate  Soyuz  conflict  threat 


Figure  6.2-4.  By  late  2002,  the  vehicle  processing  team  at  the  Kennedy  Space  Center  would  be  required  to  work  through  the  winter  holi- 
days, and  a  third  shift  was  being  hired  in  order  to  meet  the  February  19,  2004,  schedule  for  U.S.  Core  Complete. 
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refurbishment  is  perfonned  in  tiie  three  Orbiter  Processing 
Facilities  at  Kennedy.  One  was  occupied  by  Discovery  dur- 
ing its  scheduled  extended  maintenance.  This  left  two  to 
serve  the  other  three  Orbiters  over  the  next  several  months. 
The  2003  schedule  indicated  plans  to  move  Columbia  (after 
its  return  from  STS- 107)  from  an  Orbiter  Processing  Facility 
to  the  Vehicle  Assembly  Building  and  back  several  times  in 
order  to  make  room  for  Atlantis  (OV-104)  and  Endeavour 
(OV-105)  and  prepare  them  for  missions.  Moving  an  Orbiter 
is  tedious,  time-consuming,  carefully  orchestrated  work. 
Each  move  introduces  an  opportunity  for  problems.  Those 
2003  moves  were  often  slated  to  occur  without  a  day  of  mar- 
gin between  them -another  indication  of  the  additional  risks 
that  managers  were  willing  to  incur  to  meet  the  schedule. 

The  effect  of  the  compressed  schedule  was  also  evident  in 
the  Mission  Operations  Directorate.  The  plans  for  flight  con- 
troller staffing  of  Mission  Control  showed  that  of  the  seven 
flight  controllers  who  lacked  current  certifications  during 
STS- 107  (.see  Chapter  4),  five  were  scheduled  to  work  the 
next  mission,  and  three  were  scheduled  to  work  the  next 
three  missions  (STS-114,  -115.  and  -116).  These  control- 
lers would  have  been  constantly  either  supporting  missions 
or  supporting  mission  training,  and  were  unlikely  to  have 


the  time  to  complete  the  recertification  requirements.  With 
the  pressure  of  the  schedule,  the  things  perceived  to  be  less 
important,  like  recertification  (which  was  not  done  before 
STS- 1 07),  would  likely  continue  to  be  deferred.  As  a  result 
of  the  schedule  pressure,  managers  either  were  willing  to  de- 
lay recertification  or  were  too  busy  to  notice  that  deadlines 
for  recertification  had  passed. 

Columbia:  Caught  in  the  Middle 

STS-II2  flew  in  October  2002.  At  33  seconds  into  the 
flight,  a  piece  of  the  bipod  foam  from  the  External  Tank 
struck  one  of  the  Solid  Rocket  Boosters.  As  described  in 
Section  6.1,  the  STS-112  foam  strike  was  discussed  at 
the  Program  Requirements  Control  Board  following  the 
flight.  Although  the  initial  recommendation  was  to  treat 
the  foam  loss  as  an  In-Flight  Anomaly,  the  Shuttle  Program 
instead  assigned  it  as  an  action,  with  a  due  date  after  the 
next  launch.  (This  was  the  first  instance  of  bipod  foam  loss 
that  was  not  designated  an  In-Flight  Anomaly.)  The  action 
was  noted  at  the  STS- 1 13  Flight  Readiness  Review.  Those 
Flight  Readiness  Review  charts  (see  Section  6.1)  provided 
a  flawed  flight  rationale  by  concluding  that  the  foam  loss 
was  "not  a  safety-of-flight"  issue. 
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SSP  Core  Complete  Schedule  Threats 

STS-120/Nocle  2  launch  subject  to  45  days  of  schedule  risk 

•  Space  Shuttle  technical  problems 

•  Station  on-orbit  technical  problems/mission  requirements  impact 

•  Range  launch  cutouts 

•  Weather  delays 

•  Soyuz  and  Progress  conflicts 


Management  Options 

'  USA  commit  holiday/weekend  reserves  and 
apply  additional  resources  (i.e.,  3'" shift)  to 
hold  schedule  (Note:  S'shift  not  yet  included) 

•  HQ  mitigate  Range  Cutout 

•  HQ  and  ISS  mitigate  Soyuz  conflict  threat 


Figure  6.2-5.  This  slide  sfiows  ffie  margin  for  each  Orbifer.  The  large  boxes  show  ihe  number  of  days  margin  to  the  Node  2  launch  dofe, 
while  the  three  smaller  boxes  indicate  vehicle  processing  margin,  holiday  margin,  and  the  margin  if  a  Dryden  landing  was  not  required. 
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Interestingly,  during  Columbia's  mission,  the  Chair  of  the 
Mission  Management  Team,  Linda  Ham,  would  characterize 
that  reasoning  as  "lousy"  -  though  neither  she  nor  Shuttle 
Program  Manager  Ron  Dittemore,  who  were  both  present  at 
the  meeting,  questioned  it  at  the  time.  The  pressing  need  to 
launch  STS-II3  to  retrieve  the  International  Space  Station 
Expedition  5  crew  before  they  surpassed  the  180-day  limit 
and  to  continue  the  countdown  to  Node  2  were  surely  in  the 
back  of  managers'  minds  during  these  reviews. 

By  December  2002.  every  bit  of  padding  in  the  schedule 
had  disappeared.  Another  chart  from  the  Shuttle  and  Station 
Program  Managers'  briefing  to  the  NASA  Administrator 
summarizes  the  schedule  dilemma  (see  Figure  6.2-6). 

Even  with  work  scheduled  on  holidays,  a  third  shift  of  work- 
ers being  hired  and  trained,  future  crew  rotations  drifting 
beyond  1 80  days,  and  some  tests  previously  deemed  "re- 
quirements" being  skipped  or  deferred,  Program  managers 
estimated  that  Ntide  2  launch  would  be  one  to  two  months 
late.  They  were  slowly  accepting  additional  risk  in  trying  to 
meet  a  schedule  that  probably  could  not  be  met. 

Interview;*  with  workers  provided  insight  into  how  this  situ- 
ation occurred.  They  noted  that  people  who  work  at  NASA 
have  the  legendary  can-do  attitude,  which  contributes  to  the 
agency's  successes.  But  it  can  also  cause  problems.  When 
workers  are  asked  to  find  days  of  margin,  they  work  furious- 
ly to  do  so  and  are  praised  for  each  extra  day  they  find.  But 


those  same  people  (and  this  same  culture)  have  difficulty 
admitting  that  something  "can't"  or  "shouldn't"  be  done, 
that  the  margin  has  been  cut  too  much,  or  that  resources  are 
being  stretched  too  thin.  No  one  at  NASA  wants  to  be  the 
one  to  stand  up  and  say,  "We  can't  make  that  date." 

STS-I()7  was  launched  on  .lanuary  16,  2003.  Bipod  foam 
separated  from  the  External  Tank  and  struck  Coliinihia's  left 
wing  81.9  seconds  after  liftoff.  As  the  mission  proceeded 
over  the  next  16  days,  critical  decisions  about  that  event 
would  be  made. 

The  STS-107  Mission  Management  Team  Chair,  Linda 
Ham,  had  been  present  at  the  Program  Requirements  Control 
Board  discussing  the  STS-112  foam  loss  and  the  STS-II3 
Flight  Readiness  Review.  So  had  many  of  the  other  Shuttle 
Program  managers  who  had  roles  in  STS-107.  Ham  was  also 
the  Launch  Integration  Manager  for  the  next  mission.  STS- 
1 14.  In  that  capacity,  she  would  chair  many  of  the  meetings 
leading  up  to  the  launch  of  that  flight,  and  many  of  those 
individuals  would  have  to  confront  Cohiinhia's  foam  strike 
and  its  possible  impact  on  the  launch  of  STS- 1 1 4.  Would  the 
Cnliiiiihia  foam  strike  be  classified  as  an  In-Flight  Anomaly? 
Would  the  fact  that  foam  had  detached  from  the  bipod  ramp 
on  two  out  of  the  last  three  flights  have  made  this  problem  a 
constraint  to  flight  that  would  need  to  be  solved  before  the 
next  launch?  Could  the  Program  develop  a  solid  rationale 
to  fly  STS- 1 14.  or  would  additional  analysis  be  required  to 
clear  the  flight  for  launch? 


Summary 


Critical  Path  to  U.S.  Core  Complete  driven  by 
Shuttle  Launch 

>"  Program  Station  assessment:  up  to  14  days  late 
>-  Program  Shuttle  assessment:  up  to  45  days  late 

Program  proactively  managing  schedule  threats 
Most  probable  launch  date  is  March  19-April  19 

^  Program  Target  Remains  2/19/04 


Figure  6.2-6.  By  December  2002,  every  bit  of  padding  in  the  schedule  had  disappeared.  Another  chart  from  the  Shuttle  and  Station  Pro- 
gram Managers'  briefing  to  the  NASA  Administrator  summarizes  the  schedule  dilemma. 
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Original  Message 

From:  HAM,  LINDA  J.  (JSC-MA2)  (NASA) 

Sent:  Wednesday,  January  22,  2003  10:16  AM 

To:  DITTEMORE,  RONALD  D.  (JSC-MA)  (NASA) 

Subject:         RE:  ET  Briefing  -  STS-112  Foam  Loss 

Yes,  I  remember.... It  was  not  good.  I  told  Jerry  to  address  it  at  the  ORR  next  Tuesday  (even  though 
he  won't  have  any  more  data  and  it  really  doesn't  impact  Orbiter  roll  to  the  VAB).  I  just  want  him  to  be 
thinking  hard  about  this  now,  not  wait  until  IFA  review  to  get  a  formal  action. 


fORR=Orbi>er  Ro//ouf  Review,  VA6=Vehic/e  Assembly  Budding,  /FA=/n-F//g/if  Anomaly] 


In  fact,  most  of  Linda  Ham's  inquiries  about  the  foam 
strike  were  not  to  determine  what  action  to  lai<e  during 
Columbia's  mission,  but  to  understand  the  implications  for 
STS-1 14.  During  a  Mission  Management  Team  meeting  on 
January  2 1 ,  she  asked  about  the  rationale  put  forward  at  the 
STS-1 13  Flight  Readiness  Review,  which  she  had  attended. 
Later  that  morning  she  reviewed  the  charts  presented  at 
that  Flight  Readiness  Review.  Her  assessment,  which  she 
e-mailed  to  Shuttle  Program  Manager  Ron  Dittemore  on 
January  21,  was  "Rationale  was  lousy  then  and  still  is  ..." 
(See  Section  6.3  for  the  e-mail.) 

One  of  Ham's  STS- 1 14  duties  was  to  chair  a  review  to  deter- 
mine if  the  mission's  Orbiter.  Atlantis,  should  be  rolled  from 
the  Orbiter  Processing  Facility  to  the  Vehicle  Assembly 
Building,  per  its  pre-launch  schedule.  In  the  above  e-mail  to 
Ron  Dittemore,  Ham  indicates  a  desire  to  have  the  same  in- 
dividual responsible  for  the  "lousy"  STS-1 13  flight  rationale 
start  working  the  foam  shedding  issue  -  and  presumably 
present  a  new  flight  rationale  -  very  soon. 

As  STS- 107  prepared  for  re-entry.  Shuttle  Program  manag- 
ers prepared  for  STS-1 14  flight  rationale  by  arranging  to 
have  post-flight  photographs  taken  of  Columbia's  left  wing 
rushed  to  Johnson  Space  Center  for  analysis. 

As  will  become  clear  in  the  ne.xt  section,  most  of  the  Shuttle 
Program's  concern  about  Columbia's  foam  strike  were  not 
about  the  threat  it  might  pose  to  the  vehicle  in  orbit,  but 
about  the  threat  it  might  pose  to  the  schedule. 

Conclusion 

The  agency's  commitment  to  hold  firm  to  a  February  19, 
2004,  launch  date  for  Node  2  influenced  many  of  decisions 
in  the  months  leading  up  to  the  launch  of  STS- 107.  and  may 
well  have  subtly  influenced  the  way  managers  handled  the 
STS-1 12  foam  strike  and  Columbia's  as  well. 

When  a  program  agrees  to  spend  less  money  or  accelerate 
a  schedule  beyond  what  the  engineers  and  program  man- 
agers think  is  reasonable,  a  small  amount  of  overall  risk  is 
added.  These  little  pieces  of  risk  add  up  until  managers  are 
no  longer  aware  of  the  total  program  risk,  and  are.  in  fact, 
gambling.  Little  by  little,  NASA  was  accepting  more  and 
more  risk  in  order  to  stay  on  schedule. 


Findings 


F6.2-1 


F6.2-2 


F6.2-3 


F6.2-4 


F6.2-5 


F6.2-6 


F6.2-7 


NASA  Headquarters"  focus  was  on  the  Node  2 
launch  date,  February  19.  2004. 
The  intertwined  nature  of  the  Space  Shuttle  and 
Space  Station  programs  significantly  increased 
the  complexity  of  the  schedule  and  made  meeting 
the  schedule  far  more  challenging. 
The  capabilities  of  the  system  were  being 
stretched  to  the  limit  to  support  the  schedule. 
Projections  into  2003  showed  stress  on  vehicle 
processing  at  the  Kennedy  Space  Center,  on  flight 
controller  training  at  Johnson  Space  Center,  and 
on  Space  Station  crew  rotation  schedules.  Effects 
of  this  stress  included  neglecting  flight  control- 
ler recertification  requirements,  extending  crew 
rotation  schedules,  and  adding  incremental  risk 
by  scheduling  additional  Orbiter  movements  at 
Kennedy. 

The  four  flights  scheduled  in  the  five  months 
from  October  2003.  to  February  2004,  would 
have  required  a  processing  effort  comparable  to 
the  effort  immediately  before  the  Clialleni^er  ac- 
cident. 

There  was  no  schedule  margin  to  accommodate 
unforeseen  problems.  When  flights  come  in  rapid 
succession,  there  is  no  assurance  that  anomalies 
on  one  flight  will  be  identified  and  appropriately 
addressed  before  the  next  flight. 
The  environment  of  the  countdown  to  Node  2  and 
the  importance  of  maintaining  the  schedule  may 
have  begun  to  influence  managers'  decisions, 
including  those  made  about  the  STS-112  foam 
strike. 

During  STS- 107,  Shuttle  Program  managers 
were  concerned  with  the  foam  strike's  possible 
effect  on  the  launch  schedule. 


Recommendation 

R6.2-1 


Adopt  and  maintain  a  Shuttle  flight  .schedule  that 
is  consistent  with  available  resources.  Although 
schedule  deadlines  are  an  important  management 
tool,  those  deadlines  must  be  regularly  evaluated 
to  ensure  that  any  additional  risk  incurred  to  meet 
the  schedule  is  recognized,  understood,  and  ac- 
ceptable. 
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6.3    Decision-Making  During  the  Flight  of  STS-107 

initial  Foam  Strike  Identification 

As  soon  as  Coliniihia  reached  orbit  on  the  morning  of  January  16,  2003,  NASA's  Intercenter 
Photo  Working  Group  began  reviewing  iifloff  imagery  by  video  and  film  cameras  on  the  launch 
pad  and  at  other  sites  at  and  nearby  the  Kennedy  Space  Center.  The  debris  strike  was  not  seen 
during  the  first  review  of  video  imagery  by  tracking  cameras,  but  it  was  noticed  at  9:30  a.m. 
EST  the  next  day.  Flight  Day  Two,  by  intercenter  Photo  Working  Group  engineers  at  Marshall 
Space  Flight  Center.  Within  an  hour,  Intercenter  Photo  Working  Group  personnel  at  Kennedy 
also  identified  the  strike  on  higher-resolution  film  images  that  had  just  been  developed. 

The  images  revealed  that  a  large  piece  of  debris  from  the  left  bipod  area  of  the  External  Tank 
had  struck  the  Orbiter's  left  wing.  Because  the  resulting  shower  of  post-impact  fragments  could 
not  be  seen  passing  over  the  top  of  the  wing,  analysts  concluded  that  the  debris  had  apparently 
impacted  the  left  wing  below  the  leading  edge.  Intercenter  Photo  Working  Group  members 
were  concerned  about  the  size  of  the  object  and  the  apparent  momentum  of  the  strike.  In  search- 
ing for  better  views,  Intercenter  Photo  Working  Group  members  realized  that  none  of  the  other 
cameras  provided  a  higher-quality  view  of  the  impact  and  the  potential  damage  to  the  Orbiter. 

Of  the  dozen  ground-based  camera  sites  used  to  obtain  images  of  the  ascent  for  engineering 
analyses,  each  of  which  has  film  and  video  cameras,  five  are  designed  to  track  the  Shuttle  from 
liftoff  until  it  is  out  of  view.  Due  to  expected  angle  of  view  and  atmospheric  limitations,  two 
sites  did  not  capture  the  debris  event.  Of  the  remaining  three  sites  positioned  to  "see"  at  least  a 
portion  of"  the  event,  none  provided  a  clear  view  of  the  actual  debris  impact  to  the  wing.  The  first 
site  lost  track  of  Cohiinhia  on  ascent,  the  second  site  was  out  of  focus  -  because  of  an  improp- 
erly maintained  lens  -  and  the  third  site  captured  only  a  view  of  the  upper  side  of  Coltinihia's 
left  wing.  The  Board  notes  that  camera  problems  also  hindered  the  CInilleiiiier  investigation. 
Over  the  years,  it  appears  that  due  to  budget  and  camera-team  staff  cuts,  NASA's  ability  to  track 
ascending  Shuttles  has  atrophied  -  a  development  that  reflects  NASA's  disregard  of  the  devel- 
opmental nature  of  the  Shuttle's  technology.  (See  recommendation  R3.4-I.) 

Because  they  had  no  sufficiently  resolved  pictures  with  which  to  determine  potential  damage, 
and  having  never  seen  such  a  large  piece  of  debris  strike  the  Orbiter  so  late  in  ascent,  Intercenter 
Photo  Working  Group  members  decided  to  ask  for  ground-based  imagery  of  Coliimhki. 

Imagery  Request  1 

To  accomplish  this,  the  Intercenter  Photo  Working  Group's  Chair,  Bob  Page,  contacted  Wayne 
Hale,  the  Shuttle  Program  Manager  for  Launch  Integration  at  Kennedy  Space  Center,  to  request 
imagery  of  Coliiwhia's  left  wing  on-orbit.  Hale,  who  agreed  to  explore  the  possibility,  holds  a 
Top  Secret  clearance  and  was  familiar  with  the  process  for  requesting  military  imaging  from  his 
experience  as  a  Mission  Control  Flight  Director. 

This  would  be  the  first  of  three  discrete  requests  for  imagery  by  a  NASA  engineer  or  manager. 
In  addition  to  these  three  requests,  there  were,  by  the  Board's  count,  at  least  eight  "missed  op- 
portunities" where  actions  may  have  resulted  in  the  discovery  of  debris  damage. 

Shortly  after  confirming  the  debris  hit,  Intercenter  Photo  Working  Group  members  distributed 
a  "L+l"  (Launch  plus  one  day)  report  and  digitized  clips  of  the  strike  via  e-mail  throughout  the 
NASA  and  contractor  communities.  This  report  provided  an  initial  view  of  the  foam  strike  and 
served  as  the  basis  for  subsequent  decisions  and  actions. 

Mission  Management's  Response  to  the  Foam  Strike 

As  soon  as  the  Intercenter  Working  Group  report  was  distributed,  engineers  and  technical 
managers  from  NASA,  United  Space  Alliance,  and  Boeing  began  responding.  Engineers  and 
managers  from  Kennedy  Space  Center  called  engineers  and  Program  managers  at  .lohnson 
Space  Center.  United  Space  Alliance  and  Boeing  employees  exchanged  e-mails  with  details  of 
the  initial  film  analysis  and  the  work  in  progress  to  determine  the  result  of  the  impact.  Details 
of  the  strike,  actions  taken  in  response  to  the  impact,  and  records  of  telephone  conversations 
were  documented  in  the  Mission  Control  operational  log.  The  following  section  recounts  in 

1    40  — ^— — ^-^— ^^-^^— — ^^^  Report    volume     I  August     2003  —^—^—— 


COLUMBIA 

ACCIDENT  INVESTIGATION  BDARO 


chronological  order  many  of  tliese  exchanges  and  provides  insight  into  why,  in  spite  of  the 
debris  strike's  severity.  NASA  managers  ultimately  declined  to  request  images  of  Columbia's 
left  wing  on-orbit. 

Flight  Day  Two,  Friday,  January  17,  2003 

In  the  Mission  Evaluation  Room,  a  support  function  of  the  Shuttle  Program  office  that  supplies 
engineering  expertise  for  missions  in  progress,  a  set  of  consoles  are  staffed  by  engineers  and 
technical  managers  from  NASA  and  contractor  organizations.  For  record  keeping,  each  Mission 
Evaluation  Room  member  types  mission-related  comments  into  a  running  log.  A  log  entry  by  a 
Mission  Evaluation  Room  manager  at  10:58  a.m.  Central  Standard  Time  noted  that  the  vehicle 
may  have  sustained  damage  from  a  debris  strike. 

"John  Disler  [a  photo  lab  eiif^ineer  at  Johnson  Space  Center]  called  to  report  a  debris  hit 
on  the  vehicle.  The  debris  appears  to  originate  from  the  ET  Forward  Bipod  area... travels 
down  the  left  side  and  hits  the  left  wing  leading  edge  near  the  fuselage... The  launch  video 
review  team  at  KSC  think  that  the  vehicle  nuiy  have  been  damaged  by  the  impact.  Bill 
Reeves  and  Mike  Stoner  I  USA  SAM)  were  notified. "  [EJ=Exfernal  Tank,  KSC=Kennedy  Space 
Center,  USA  SAM=United  Space  Alliance  Sub-system  Area  tAanager] 

At  3: 1 5  p.m..  Bob  Page,  Chair  of  the  Intercenter  Photo  Working  Group,  contacted  Wayne  Hale, 
the  Shuttle  Program  Manager  for  Launch  Integration  at  Kennedy  Space  Center,  and  Lambert 
Austin,  the  head  of  the  Space  Shuttle  Systems  Integration  at  Johnson  Space  Center,  to  inform 
them  that  Boeing  was  periorming  an  analysis  to  determine  trajectories,  velocities,  angles,  and 
energies  for  the  debris  impact.  Page  also  stated  that  photo-analysis  would  continue  over  the 
Martin  Luther  King  Jr.  holiday  weekend  as  additional  film  from  tracking  cameras  was  devel- 
oped. Shortly  thereafter,  Wayne  Hale  telephoned  Linda  Ham,  Chair  of  the  Mission  Manage- 
ment Team,  and  Ron  Dittemore,  Space  Shuttle  Program  Manager,  to  pass  along  information 
about  the  debris  strike  and  let  them  know  that  a  formal  report  would  be  issued  by  the  end  of 
the  day.  John  Disler,  a  member  of  the  Intercenter  Photo  Working  Group,  notified  the  Mission 
Evaluation  Room  manager  that  a  newly  formed  group  of  analysts,  to  be  known  as  the  Debris 
Assessment  Team,  needed  the  entire  weekend  to  conduct  a  more  thorough  analysis.  Meanwhile, 
early  opinions  about  Reinforced  Carbon-Carbon  (RCC)  resiliency  were  circulated  via  e-mail 
between  United  Space  Alliance  technical  managers  and  NASA  engineers,  which  may  have 
contributed  to  a  mindset  that  foam  hitting  the  RCC  was  not  a  concern. 


— Original  Message 

From:  Stoner- 1,  Michael  D 

Sent:  Friday,  January  17,  2003  4:03  PM 

To:  Woodworth,  Warren  H;  Reeves,  William  D 

Cc:  Wilder,  James;  White,  Doug;  Bitner,  Barbara  K;  Blank,  Donald  E;  Cooper,  Curt  W;  Gordon,  Michael  P. 

Subject:  RE:  STS  107  Debris 

Just  spoke  with  Calvin  and  Mike  Gordon  (RCC  SSM)  about  the  impact. 

Basically  the  RCC  is  extremely  resilient  to  impact  type  damage.  The  piece  of  debris  (most  likely 
foam/ice)  looked  like  it  most  likely  impacted  the  WLE  RCC  and  broke  apart.  It  didn't  look  like  a  big 
enough  piece  to  pose  any  serious  threat  to  the  system  and  Mike  Gordon  the  RCC  SSM  concurs.  At  T 
+81  seconds  the  piece  wouldn't  have  had  enough  energy  to  create  a  large  damage  to  the  RCC  WLE 
system.  Plus  they  have  analysis  that  says  they  have  a  single  mission  safe  re-entry  in  case  of  impact 
that  penetrates  the  system. 

As  far  as  the  tile  go  in  the  wing  leading  edge  area  they  are  thicker  than  required  (taper  in  the  outer 
mold  line)  and  can  handle  a  large  area  of  shallow  damage  which  is  what  this  event  most  likely  would 
have  caused.  They  have  impact  data  that  says  the  structure  would  get  slightly  hotter  but  still  be  OK. 

Mike  Stoner 
USATPSSAM 


fRCC=Reinforced  Corbon-Corbon,  SSM=Sub-system  Manager,  WLE=Wing  Leading  Edge,  TPS=Thermal  Protection  System, 
SAA/t=  Sub-system  Area  Manager] 
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Engineering  Coordination  at  NASA 
AND  United  Space  Alliance 

After  United  Space  Alliance  became  contractually  responsible  for  most  aspects  of  Shuttle  operations. 
NASA  developed  procedures  to  ensure  that  its  own  engineering  expertise  was  coordinated  with  that 
of  contractors  for  any  "out-of-f'amily"  issue.  In  the  case  of  the  foam  strike  on  STS-1()7,  which  was 
classified  as  out-of-family.  clearly  defined  written  guidance  led  United  Space  Alliance  technical  man- 
agers to  liaise  with  their  NASA  counterparts.  Once  NASA  managers  were  officially  notified  of  the 
foam  strike  classification,  and  NASA  engineers  joined  their  contractor  peers  in  an  early  analysis,  the 
resultant  group  should,  according  to  standing  procedures,  become  a  Mission  Evaluation  Room  I'iger 
Team.  Tiger  Teams  have  clearly  defined  roles  and  responsibilities.'*-  Instead,  the  group  of  analysts 
came  to  be  called  a  Debris  Assessment  Team.  While  they  were  the  right  group  of  engineers  work- 
ing the  problem  at  the  right  time,  by  not  being  classified  as  a  Tiger  learn,  they  did  not  fall  under  the 
Shuttle  Program  procedures  described  in  Tiger  Team  checklists,  and  as  a  result  were  not  "owned"  or 
led  by  Shutde  Program  managers.  This  left  the  Debris  Assessment  Team  in  a  kind  of  organizational 
limbo,  with  no  guidance  except  the  date  by  which  Program  managers  expected  to  hear  their  results: 
.lanuary  24th. 


Already,  by  Friday  afternoon.  Shuttle  Program  managers  and  working  engineers  had  different 
levels  of  concern  about  what  the  foam  strike  might  have  meant.  After  reviewing  available  film. 
Intercenter  Photo  Working  Group  engineers  believed  the  Orbiter  may  have  been  damaged  by 
the  strik(^.  They  wanted  on-orbit  images  of  Columbia's  left  wing  to  confirm  their  suspicions 
and  initiated  action  to  obtain  them.  Boeing  and  United  Space  Alliance  engineers  decided  to 
work  through  the  holiday  weekend  to  analyze  the  strike.  At  the  same  time,  high-level  managers 
Ralph  Roe.  head  of  the  Shuttle  Program  Office  of  Vehicle  Engineering,  and  Bill  Reeves,  from 
United  Space  Alliance,  voiced  a  lower  level  of  concern.  It  was  at  this  point,  before  any  analysis 
had  started,  that  Shuttle  Program  managers  officially  shared  their  belief  that  the  strike  posed  no 
safety  issues,  and  that  there  was  no  need  for  a  review  to  be  conducted  over  the  weekend.  The 
following  is  a  4;28  p.m.  Mission  Evaluation  Room  manager  log  entry: 

"Bill  Reeves  called,  after  a  meetiii!^  with  Ralph  Roe.  it  is  confirmed  that  USA/Boeing  will 
no!  work  the  debris  issue  over  the  weekend,  but  will  wait  till  Monday  when  the  films  are 
released.  The  LCC  constraints  on  ice,  the  ener^iyLspeed  of  impact  at  +8 J  .seconds,  and  the 
loui^hness  of  the  RCC  are  t^vo  main  fiictors  ft)r  the  low  concern.  Al.so,  analysis  supports 
sin,i;le  mission  safe  re-entry  for  an  impact  that  penetrates  the  system. . . "  fUSA=Uni>ec/  Space 
Alliance,  LCC=Launch  Commit  Criteria] 

The  following  is  a  4:37  p.m.  Mission  Evaluation  Room  manager  log  entry. 

"Bob  Paiie  told  MER  that  KSC/TPS  engineers  were  sent  by  the  USA  SAM/Woody  Wood- 
worth  to  review  the  video  and  films.  Indicated  that  Pa^e  had  said  that  Woody  had  said  this 
was  an  action  fi-om  the  MER  to  work  this  issue  and  a  possible  early  landing!,  on  Tue.ulay. 
MER  Manai^er  told  Bob  that  no  official  action  was  given  by  USA  or  Boeinf^  and  they  had 
no  c(mcern  about  landinfi  early.  Woody  indicated  that  the  TPS  engineers  at  KSC  have  been 
'turned  away'  from  reviewing  the  films.  It  was  stated  that  the  film  reviews  wouldn't  be  fin- 
ished till  Monday. "  [MER=Mission  Evaluation  Room,  KSC=Kennedy  Space  Center,  TPS=Thermal 
Protection  System,  USA  SAM=United  Space  Alliance  SuJb-sysfem  Areo  Manager] 

The  Mission  Evaluation  Room  manager  also  wrote: 

"7  also  confirmed  that  there  was  no  rush  on  this  issue  and  that  it  was  okay  to  wait  till  the 
film  reviews  are  finished  on  Monday  to  do  a  TPS  review. " 

in  addition  to  individual  log  entries  by  Mission  Evaluation  Room  members,  managers  prepared 
"handover"  notes  for  delivery  from  one  working  shift  to  the  next.  Handovers  from  Shift  1  to  2 
on  .January  17  included  the  following  entry  under  a  "problem"  category. 

'"Disler  Report  -  Debris  impact  on  port  wing  edge-appears  to  have  origincued  at  the  ET 
fvd  bipod  -foam?-  if  so,  it  shouldn  V  be  a  problem  -  video  clip  will  be  available  on  the  web 
.soon  -  will  look  at  high-speed  film  today. "  [ET=External  Tank,  fwd={orward] 
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Shortly  after  these  entries  were  made,  the  deputy  manager  of  Johnson  Space  Center  Shuttle  En- 
gineering notified  Rodney  Rocha,  NASA's  designated  chief  engineer  for  the  Thermal  Protection 
System,  of  the  strike  and  the  approximate  debris  size.  It  was  Rocha's  responsibility  to  coordinate 
NASA  engineering  resources  and  work  with  contract  engineers  at  United  Space  Alliance,  who 
together  would  form  a  Debris  Assessment  Team  that  would  be  Co-Chaired  by  United  Space  Al- 
liance engineering  manager  Pam  Madera.  The  United  Space  Alliance  deputy  manager  of  Shuttle 
Engineering  signaled  that  the  debris  strike  was  initially  classified  as  "out-of-family"  and  there- 
fore of  greater  concern  than  previous  debris  strikes.  At  about  the  same  time,  the  Intercenter  Photo 
Working  Group's  L+l  report,  containing  both  video  clips  and  still  images  of  the  debris  strike, 
was  e-mailed  to  engineers  and  technical  managers  both  inside  and  outside  of  NASA. 

Flight  Days  Three  and  Four,  Saturday  and  Sunday,  January  18  and  19,  2003 

Though  senior  United  Space  Alliance  Manager  Bill  Reeves  had  told  Mission  Evaluation  Room 
personnel  that  the  debris  problem  would  not  be  worked  over  the  holiday  weekend,  engineers 
from  Boeing  did  in  fact  work  through  the  weekend.  Boeing  analysts  conducted  a  preliminary 
damage  assessment  on  Saturday.  Using  video  and  photo  images,  they  generated  two  estimates 
of  possible  debris  size  -  20  inches  by  20  inches  by  2  inches,  and  20  inches  by  16  inches  by  6 
inches  -  and  determined  that  the  debris  was  traveling  at  a  approximately  750  feet  per  second, 
or  51 1  miles  per  hour,  when  it  struck  the  Orbiter  at  an  estimated  impact  angle  of  less  than  20 
degrees.  These  estimates  later  proved  remarkably  accurate. 

To  calculate  the  damage  that  might  result  from  such  a  strike,  the  analysts  turned  to  a  Boeing 
mathematical  modeling  tool  called  Crater  that  uses  a  specially  developed  algorithm  to  predict 
the  depth  of  a  Thermal  Protection  System  tile  to  which  debris  will  penetrate.  This  algorithm,  suit- 
able for  estimating  small  (on  the  order  of  three  cubic  inches)  debris  impacts,  had  been  calibrated 
by  the  results  of  foam,  ice,  and  metal  debris  impact  testing.  A  similar  Crater-like  algorithm  was 
also  developed  and  validated  with  test  results  to  assess  the  damage  caused  by  ice  projectiles 
impacting  the  RCC  leading  edge  panels.  These  tests  showed  that  within  certain  limits,  the  Crater 
algorithm  predicted  more  severe  damage  than  was  observed.  This  led  engineers  to  classify  Crater 
as  a  "conservative"  tool  -  one  that  predicts  more  damage  than  will  actually  occur. 

Until  STS-107,  Crater  was  normally  used  only  to  predict  whether  small  debris,  usually  ice  on 
the  External  Tank,  would  pose  a  threat  to  the  Orbiter  during  launch.  The  use  of  Crater  to  assess 
the  damage  caused  by  foam  during  the  launch  of  STS- 1 07  was  the  first  use  of  the  model  while 
a  mission  was  on  orbit.  Al.so  of  note  is  that  engineers  used  Crater  during  STS-107  to  analyze  a 
piece  of  debris  that  was  at  maximum  640  times  larger  in  volume  than  the  pieces  of  debris  used 
to  calibrate  and  validate  the  Crater  model  (the  Board's  best  estimate  is  that  it  actually  was  400 
times  larger).  Therefore,  the  u.se  of  Crater  in  this  new  and  very  different  situation  compromised 
NASA's  ability  to  accurately  predict  debris  damage  in  ways  that  Debris  Assessment  Team  en- 
gineers did  not  fully  comprehend  (see  Figure  6.3-1 ). 


Figure  6,3-?.  The  small  cylinder  at  top  illustrates  the  size  of  debris  Crater  was  intended  to  analyze.  The 
larger  cylinder  was  used  for  the  STS-107  analysis;  the  block  at  right  is  the  estimated  size  of  the  foam. 
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The  Crater  Model 

0.0195(L/cI)0.45(d)(p^)°^'(V-V*)'/' 

p  =  penetration  depth 

L  =  length  of  foam  projectile 

d  =  diameter  of  foam  projectile 

f)p  =  density  of  foam 

V  =  component  of  foam  velocity  at  right  angle  to  foam 

V*  =  velocity  required  to  break  through  the  tile  coating 

Sj  -  compressive  strength  of  tile 

()j  =  density  of  tile 

0.0195   =  empirical  consfanf 

In  I  %6,  during  the  Apollo  proeram,  engineers  developed  an  equation  to  assess  impact  damage,  or  "cra- 
tering,"  by  micrometeoroids.  The  equation  was  modified  between  1 979  and  1 985  to  enable  the  analy- 
sis of  impacts  to  "acreage"  tiles  that  cover  the  lower  surface  of  the  Orbiter.  "  The  modified  equation, 
now  known  a>,  ( "rater,  predicts  possible  damage  from  sources  such  as  foam,  ice,  and  launch  site  debris, 
and  is  most  often  used  in  the  day-of-launch  analysis  of  ice  debris  falling  off  the  External  Tank. 

When  used  within  its  validated  limits,  Crater  provides  conservative  predictions  (that  is.  Crater  pre- 
dictions are  larger  than  actual  damage).  When  used  outside  its  validated  limits.  Crater's  precision  is 
unknown. 

Crater  has  been  correlated  to  actual  impact  data  using  results  from  several  tests.  Preliminary  ice  drop 
tests  were  performed  in  1978,^'  and  additional  tests  using  sprayed-on  foam  insulation  projectiles 
were  conducted  in  1979  and  1999.'*'^  However,  the  test  projectiles  were  relatively  small  (maximum 
volume  of  3  cubic  inches),  and  targeted  only  single  tiles,  not  groups  of  tiles  as  actually  installed  on 
the  Orbiter.  No  tests  were  perfonned  with  larger  debris  objects  because  it  was  not  believed  such 
debris  could  ever  impact  the  Orbiter.  This  resulted  in  a  very  limited  set  of  conditions  under  which 
Crater's  results  were  empirically  validated. 

During  1984.  tests  were  conducted  using  ice  projectiles  against  the  Reinforced  Carbon-Carbon  used 
on  the  Orbiler^■  w  ing  leading  edges.'*'^  These  tests  used  an  0.875-inch  diameter,  .^.75-inch  long  ice 
projectile  to  validate  an  algorithm  that  was  similar  to  Crater.  Unlike  Crater,  which  was  designed  to 
predict  damage  during  a  flight,  the  RCC  predictions  were  intended  to  determine  the  thickness  of  RCC 
required  to  withstand  ice  impacts  as  an  aid  to  design  engineers.  Like  Crater,  however,  the  limited  set 
of  test  data  significantly  restricts  the  potential  application  of  the  model. 

Other  damage  assessniciii  methods  available  today,  such  as  hydrodynamic  structural  codes,  like 
Dyna,  are  able  to  anal y/c  a  larger  set  of  projectile  sizes  and  materials  than  Crater.  Boeing  and  NASA 
did  not  currently  sanction  these  finite  element  codes  because  of  the  time  required  to  correlate  their 
results  in  order  to  use  the  models  effectively. 

Although  Crater  was  designed,  and  certified,  for  a  very  limited  set  of  impact  events,  the  results  from 
Crater  simulations  can  be  generated  quickly.  During  S'fS-107,  this  led  to  Crater  being  used  to  model 
an  event  that  was  well  outside  the  parameters  against  which  it  had  been  empirically  validated.  As  the 
accompanying  table  shows,  many  of  the  STS-107  debris  characteristics  were  orders  of  magnitude 
outside  the  validated  envelope.  For  instance,  while  Crater  had  been  designed  and  validated  for  pro- 
jectiles up  to  3  cubic  inches  in  volume,  the  initial  STS-107  analysis  estimated  the  piece  of  debris  at 
1 ,200  cubic  inches  -  400  times  larger. 

Crater  paramefers  used  during  development  of  experimental  test  data  versus  STS-107 
analysis: 


Tesf  Paramefer 

Tesf  Value 

STS-107  Analysis 

Volume 

Up  to  3  cu.in 

10"  X  6"  X  20"  =  1200  cu.in.  * 

Length 

Up  to  1  inch 

~  20  inches  * 

Cylinder  Dimensions 

<=  3/8"  dia  x  3" 

6"  dia  X  20" 

Projectile  Block  Dimensions 

<=  3"x  1  "x  1 " 

6"  X  10"  X  20"  * 

Tile  Material 

LI-900  "acreage"  tile 

LI-2200  *  and  LI-900 

Projectile  Shape 

Cylinder 

Block 

Outside  experimental  test  limits 
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Crater  equation  parameter  lim 

its: 

Crater  Equation  Parameter 

Applicable  Range 

STS-1 07  Analysis 

L/d 

1   -  20 

3.3 

L 

n/a 

~  20  inches 

Pj 

1  -  3  pounds  per  cu.ft. 

2.4  pounds  per  cu.ft. 

d 

0.4  -  2.0  inches 

6  inches  * 

V 

up  to  810  fps 

~  700  fps 

*  Outside  validated  limits 

Over  the  weekend,  an  engineer  certified  by  Boeing  to  use  Crater  entered  the  two  estimated 
debris  dimensions,  the  estimated  debris  velocity,  and  the  estimated  angle  of  impact.  The  en- 
gineer had  received  formal  training  on  Crater  from  senior  Houston-based  Boeing  engineering 
staff,  but  he  had  only  used  the  program  twice  before,  and  had  reservations  about  using  it  to 
model  the  piece  of  foam  debris  that  struck  Columbia.  The  engineer  did  not  consult  with  more 
experienced  engineers  from  Boeing's  Huntington  Beach.  California,  facility,  who  up  until  the 
time  of  STS- 107  had  performed  or  overseen  Crater  analysis.  (Boeing  completed  the  transfer  of 
responsibilities  for  Crater  analysis  from  its  Huntington  Beach  engineers  to  its  Houston  office 
in  January  2003.  STS- 1 07  was  the  first  mission  that  the  Huntington  Beach  engineers  were  not 
directly  involved  with.) 

For  the  TheiTnal  Protection  System  tile.  Crater  predicted  damage  deeper  than  the  actual  tile 
thickness.  This  seemingly  alarming  result  suggested  that  the  debris  that  struck  Columbia 
would  have  exposed  the  Orbiter's  underlying  aluminum  airframe  to  extreme  temperatures, 
resulting  in  a  possible  burn-through  during  re-entry.  Debris  Assessment  Team  engineers  dis- 
counted the  possibility  of  burn  through  for  two  reasons.  First,  the  results  of  calibration  tests 
with  small  projectiles  showed  that  Crater  predicted  a  deeper  penetration  than  would  actually 
occur.  Second,  the  Crater  equation  does  not  take  into  account  the  increased  density  of  a  tile's 
lower  "densified"  layer,  which  is  much  stronger  than  tile's  fragile  outer  layer.  Therefore,  engi- 
neers judged  that  the  actual  damage  from  the  large  piece  of  foam  lost  on  STS- 107  would  not 
be  as  severe  as  Crater  predicted,  and  assumed  that  the  debris  did  not  penetrate  the  Orbiter's 
skin.  This  uncertainty,  however,  meant  that  determining  the  precise  location  of  the  impact  was 
paramount  for  an  accurate  damage  estimate.  Some  areas  on  the  Orbiter's  lower  surface,  such 
as  the  seals  around  the  landing  gear  doors,  are  more  vulnerable  than  others.  Only  by  knowing 
precisely  where  the  debris  struck  could  the  analysts  more  accurately  determine  if  the  Orbiter 
had  been  damaged. 

To  determine  potential  RCC  damage,  analysts  used  a  Crater-like  algorithm  that  was  calibrated 
in  1984  by  impact  data  from  ice  projectiles.  At  the  time  the  algorithm  was  empirically  tested, 
ice  was  considered  the  only  realistic  threat  to  RCC  integrity.  (See  Appendix  E.4,  RCC  Impact 
Analysis.)  The  Debris  Assessment  Team  analysis  indicated  that  impact  angles  greater  than  15 
degrees  would  result  in  RCC  penetration.  A  separate  "transport"  analysis,  which  attempts  to 
determine  the  path  the  debris  took,  identified  15  strike  regions  and  angles  of  impact.  Twelve 
transport  scenarios  predicted  an  impact  in  regions  of  Shuttle  tile.  Only  one  scenario  predicted 
an  impact  on  the  RCC  leading  edge,  at  a  2 1  -degree  angle.  Because  the  foam  that  struck  Cohuu- 
bia  was  less  dense  than  ice.  Debris  Assessment  Team  analysts  used  a  qualitative  extrapolation 
of  the  test  data  and  engineering  judgment  to  conclude  that  a  foam  impact  angle  up  to  2 1  degrees 
would  not  penetrate  the  RCC.  Although  some  engineers  were  uncomfortable  with  this  extrapo- 
lation, no  other  analyses  were  performed  to  assess  RCC  damage.  The  Debris  Assessment  Team 
focused  on  analyzing  the  impact  at  locations  other  than  the  RCC  leading  edge.  This  may  have 
been  due,  at  least  in  part,  to  the  transport  analysis  presentation  and  the  long-standing  belief 
that  foam  was  not  a  threat  to  RCC  panels.  The  assumptions  and  uncertainty  embedded  in  this 
analysis  were  never  fully  presented  to  the  Mission  Evaluation  Room  or  the  Mission  Manage- 
ment Team. 

Missed  Opportunity  1 

On  Sunday,  Rodney  Rocha  e-mailed  a  Johnson  Space  Center  Engineering  Directorate  manager 
to  ask  if  a  Mission  Action  Request  was  in  progress  for  Columbia'^  crew  to  visually  inspect  the 
left  wing  for  damage.  Rocha  never  received  an  answer. 
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This  photo  from  the  aft  flighf  deck  window  of  an  Orbiter  shows  that  RCC  panels  1-11  are  not  visible 
from  inside  the  Orbiter.  Since  Columbia  did  not  have  a  manipulator  arm  for  STS-107,  it  would  have  been 
necessary  for  an  astronaut  to  take  a  spacewalk  to  visibly  inspect  the  inboard  leading  edge  of  the  wing. 


Flight  Day  Five,  Monday,  January  20,  2003 

On  Monday  morning,  the  Martin  Luther  King  Jr  holiday,  the  Debris  Assessment  Team  held  an 
informal  meeting  before  its  first  formal  meeting,  which  was  scheduled  for  Tuesday  afternoon. 
The  team  expanded  to  include  NASA  and  Boeing  transport  analysts  expert  in  the  movement 
of  debris  in  airflows,  tile  and  RCC  experts  from  Boeing  and  NASA,  aerothermal  and  thermal 
engineers  from  NASA,  United  Space  Alliance,  and  Boeing,  and  a  safety  representative  from  the 
NASA  contractor  Science  Applications  International  Corporation. 

Engineers  emerged  from  that  informal  meeting  with  a  goal  of  obtaining  images  from  ground- 
based  assets.  Uncertainty  as  to  precisely  where  the  debris  had  struck  Columbia  generated  con- 
cerns about  the  possibility  of  a  breach  in  the  left  main  landing  gear  door  seal.  They  conducted 
further  analysis  using  angle  and  thickness  variables  and  thermal  data  obtained  by  personnel  at 
Boeing's  Huntington'^Bea^ch  facility  for  STS-87  and  STS-50.  the  two  missions  that  had  incurred 
Thermal  Protection  System  damage.  (See  Section  6.1.) 

Debris  Assessment  Team  Co-Chair  Pam  Madera  distributed  an  e-mail  summarizing  the  day's 
events  and  outlined  the  agenda  for  Tuesday's  first  formal  Debris  Assessment  Team  meeting. 
Included  on  the  agenda  was  the  desire  to  obtain  on-orbit  images  of  Columbia's  left  wing. 

According  to  an  1 1 :39  a.m.  entry  in  the  Mission  Evaluation  Room  Manager's  log: 

". .  .the  debri.s  'blob '  is  estimated  at  20 "  +/-I0 "  in  .some  direction,  u.sini^  the  Orbiter  hatch 
as  a  basis.  It  appears  to  be  similar  size  as  that  .seen  in  STS-J12.  There  will  be  more  com- 
parison work  done,  and  more  info  and  details  in  tomorrow's  report." 

This  entry  illustrates,  in  NASA  language,  an  initial  attempt  by  managers  to  classify  this  bipod 
ramp  foam  strike  as  close  to  being  within  the  experience  base  and  therefore,  being  almost  an 
"in-family"  event,  not  necessarily  a  safety  concern.  While  the  size  and  source  of  STS-107  de- 
bris was  somewhat  similar  to  what  STS-1 1 2  had  experienced,  the  impact  sites  (the  wing  versus 
the  Solid  Rocket  Booster)  differed  -  a  distinction  not  examined  by  mission  managers. 
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Flight  Day  Six,  Tuesday,  January  21,  2003 

At  7:00  a.m..  the  Debris  Assessment  Team  briefed  Don  McCormaci<,  the  chief  Mission  Evalu- 
ation Room  manager,  that  the  foam's  source  and  size  was  similar  to  what  struck  STS-112,  and 
that  an  analysis  of  measured  versus  predicted  tile  damage  from  STS-87  was  being  scrutinized 
by  Boeing.  An  hour  later.  McCormack  related  this  information  to  the  Mission  Management 
Team  at  its  first  post-holiday  meeting.  Although  Space  Shuttle  Program  requirements  state  that 
the  Mission  Management  Team  will  convene  daily  during  a  mission,  the  STS-107  Mission 
Management  Team  met  only  on  January  1 7.  2 1 ,  24,  27,  and  3 1 .  The  transcript  below  is  the  first 
record  of  an  official  discussion  of  the  debris  impact  at  a  Mission  Management  Team  meeting. 
Before  even  referring  to  the  debris  strike,  the  Mission  Management  Team  focused  on  end-of- 
mission  "downweight"  (the  Orbiter  was  150  pounds  over  the  limit),  a  leaking  water  separator, 
a  jammed  Hasselblad  camera,  payload  and  experiment  status,  and  a  communications  downlink 
problem.  McCormack  then  stated  that  engineers  planned  to  determine  what  could  be  done  if 
ColiiiiihUi  had  sustained  damage.  STS-107  Mission  Management  Team  Chair  Linda  Ham  sug- 
gested the  team  learn  what  rationale  had  been  used  to  fly  after  External  Tank  foam  losses  on 
STS-87  and  STS-112, 

Transcript  Excerpts  from  the  January  21,  Mission  Management  Team  Meeting 

Ham.-  "Alrii^lit.  I  kiion-  yon  i>iiys  are  lookiiii;  at  llie  debris. " 

McCormack;  "Yeah,  as  e\x'r\hoci\  knows,  we  look  a  hit  on  the,  somewhere  on  the  left  wing 
leading  edge  and  the  photo  TV  guys  have  completed  I  think,  pretty  much  their  work  although 
I'm  sure  they  are  reviewing  their  stuff  and  they've  given  us  an  approximate  size  for  the  debris 
and  approximate  area  for  where  it  came  from  and  approximately  where  it  hit.  so  we  are  talking 
about  doing  .some  sort  of  parametric  type  of  analysis  and  also  we  're  talking  about  what  you  can 
do  in  the  event  we  have  some  damage  there. " 

Ham;  "That  comment.  I  was  thinking  that  the  flight  rationale  at  the  FRR  from  tank  and  orbiter 
from  STS-1 12  was....  I'm  iu)t  sure  that  the  area  is  exactly  the  same  where  the  foam  came  from 
hut  the  carrier  properties  and  density  of  the  foam  wouldn  't  do  any  damage.  So  we  ought  to  pull 
that  along  with  the  H7  data  where  we  had  some  damage,  pull  this  data  p'om  J 12  or  whatever 
flight  it  was  and  make  sure  that. .  .you  know  I  hope  that  we  had  good  flight  rationale  then. " 

McCormack;  "Yeah,  and  we'll  look  at  that,  you  mentioned  H7.  you  know  we  saw  some  fairly 
significant  damage  in  the  area  between  RCC  panels  H  and  9  and  the  main  landing  gear  door  on 
the  bottom  on  STS-H7  we  did  some  analysis  prior  to  STS-H9  so  uh. . . " 

Ham;  "And  I'm  really  I  don 't  think  there  is  much  we  can  do  so  it's  not  really  a  factor  during  the 
flight  because  there  is  not  much  we  can  do  about  it.  But  what  I'm  really  interested  in  is  making 
sure  our  flight  rationale  to  go  was  good,  and  maybe  this  is  foam  from  a  different  area  and  I'm 
not  sure  and  it  may  not  be  co-related,  but  you  can  try  to  see  what  we  have. " 

McCormack;  "Okay." 

After  the  meeting,  the  rationale  for  continuing  to  fly  after  the  STS-1 12  foam  loss  was  sent  to 
Ham  for  review.  She  then  exchanged  e-mails  with  her  boss,  Space  Shuttle  Program  Manager 
Ron  Dittemore: 

Original  Message 

From:  DITTEMORE,  RONALD  D.  (JSC-MA)  (NASA) 

Sent:  Wednesday,  January  22,  2003  9:14  AM 

To:  HAM,  LINDA  J.  (JSC-MA2)  (NASA) 

Subject:  RE:  ET  Briefing  -  STS-112  Foam  Loss 

You  remember  the  briefing!  Jerry  did  it  and  had  to  go  out  and  say  that  the  hazard  report  had  not 
changed  and  that  the  risk  had  not  changed... But  it  is  worth  looking  at  again. 
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Original  Message 

From:  HAM,  LINDA  J.  (JSC-MA2)  (NASA) 

Sent:  Tuesday,  January  21,  2003  11:14  AM 

To:  DITTEMORE,  RONALD  D.  (JSC-MA)  (NASA) 

Subject:  FW:  ET  Briefing  -  STS-112  Foam  Loss 

You  probably  can't  open  the  attachment.  But,  the  ET  rationale  for  flight  for  the  STS-112  loss  of  foam 
was  lousy.  Rationale  states  we  haven't  changed  anything,  we  haven't  experienced  any  'safety  of  flight' 
damage  in  112  flights,  risk  of  loss  of  bi-pod  ramp  TPS  is  same  as  previous  fights... So  ET  is  safe  to  fly 
with  no  added  risk 

Rationale  was  lousy  then  and  still  is.... 

— Original  Message 

From:  MCCORMACK,  DONALD  L.  (DON)  (JSC-MV6)  (NASA) 

Sent:  Tuesday,  January  21,  2003  9:45  AM 

To:  HAM,  LINDA  J.  (JSC-MA2)  (NASA) 

Subject:  FW:  ET  Briefing  -  STS-112  Foann  Loss 

Importance:  High 

FYI  -  it  kinda  says  that  it  will  probably  be  all  right 


fORR=Operafiona/  Readiness  Review,  VA6=Vefiic/e  Assembly  Sui/ding,  IFA=ln-Flight  Anomaly,  TPS=Thermal  Protection  Sys- 
tem, ET=External  Tank] 


Ham's  focus  on  examining  the  rationale  for  continuing  to  fly  after  the  foam  problems  with 
STS-87  and  STS-1 12  indicates  that  her  attention  had  already  shifted  from  the  threat  the  foam 
posed  to  STS-107  to  the  downstream  implications  of  the  foam  strike.  Ham  was  due  to  serve, 
along  with  Wayne  Hale,  as  the  launch  integration  manager  for  the  next  mission,  STS-1 14.  If  the 
Shuttle  Program's  rationale  to  fiy  with  foam  loss  was  found  to  be  flawed,  .STS-1 14,  due  to  be 
launched  in  about  a  month,  would  have  to  be  delayed  per  NASA  rules  that  require  serious  prob- 
lems to  be  resolved  before  the  next  flight.  An  STS-1 14  delay  could  in  turn  delay  completion  of 
the  International  Space  Station's  Node  2,  which  was  a  high-priority  goal  for  NASA  managers. 
(See  Section  6.2  for  a  detailed  description  of  schedule  pressures.) 

During  this  same  Mission  Management  Team  meeting,  the  Space  Shuttle  Integration  Office's 
Lambert  Austin  reported  that  engineers  were  reviewing  long-range  tracking  film  and  that  the 
foam  debris  that  appeared  to  hit  the  left  wing  leading  edge  may  have  come  from  the  bipod  area 
of  the  External  Tank.  Austin  said  that  the  Engineering  Directorate  would  continue  to  run  analy- 
ses and  compare  this  foam  loss  to  that  of  STS-1 12.  Austin  al.so  said  that  after  STS-i()7  landed, 
engineers  were  anxious  to  see  the  crew-filmed  footage  of  External  Tank  separation  that  might 
show  the  bipod  ramp  and  therefore  could  be  checked  for  missing  foam. 

Missed  Opportunity  2 

Reviews  of  flight-deck  footage  confirm  that  on  Flight  Day  One,  Mission  Specialist  David  Brown 
filmed  parts  of  the  External  Tank  separation  with  a  Sony  PD-K)()  Camcorder,  and  Payload  Com- 
mander Mike  Anderson  photographed  it  with  a  Nikon  F-5  camera  with  a  400-millimeter  lens. 
Brown  later  downlinked  .-^5  seconds  of  this  video  to  the  ground  as  part  of  his  Flight  Day  One  mis- 
sion summary,  but  the  bipod  ramp  area  had  rotated  out  of  view,  so  no  evidence  of  missing  foam 
was  seen  when  this  footage  was  reviewed  during  the  mission.  However,  after  the  Intercenter 
Photo  Working  Group  caught  the  debris  strike  on  January  17,  ground  personnel  failed  to  ask 
Brown  if  he  had  additional  footage  of  External  Tank  separation.  Based  on  how  crews  are  trained 
to  film  External  Tank  separation,  the  Board  concludes  Brown  did  in  fact  have  more  film  than  the 
35  seconds  he  downlinked.  Such  footage  may  have  confirmed  that  foam  was  missing  from  the 
bipod  ramp  area  or  could  have  identified  other  areas  of  missing  foam.  Austin's  mention  of  the 
crew  "s  filming  of  External  Tank  separation  should  have  prompted  someone  at  the  meeting  to  ask 
Brown  if  he  had  more  External  Tank  separation  film,  and  if  so.  to  downlink  it  immediately. 
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Flight  Director  Steve  Stich  discussed  the  debris  strike  with  Phil  Engelauf,  a  member  of  the 
Mission  Operations  Directorate,  after  Engelauf  returned  from  the  Mission  Management  Team 
meeting.  As  written  in  a  timeline  Stich  composed  after  the  accident,  the  conversation  included 
the  following. 

"Pliil  said  the  Space  Shuttle  Program  community-  is  not  concerned  and  that  Orhiter  Project 
is  analy:.ini>  ascent  debris. .  .relayed  that  there  had  been  no  direction  for  MOD  to  ask  DOD 
for  any  photography  of  possible  damaged  tiles"  [MOD=Mission  Operafions  Direcforate,  or 
Aiission  Conirol,  DOD=Deparfmenf  of  Defense] 

"No  direction  for  DOD  photography"  seems  to  refer  to  either  a  previous  discussion  of  pho- 
tography with  Mission  managers  or  an  expectation  of  future  activity.  Since  the  interagency 
agreement  on  imaging  support  stated  that  the  Flight  Dynamics  Officer  is  responsible  for  initiat- 
ing such  a  request,  Engelauf 's  comments  demonstrates  that  an  informal  chain  of  command,  in 
which  the  Mission  Operations  Directorate  figures  prominently,  was  at  work. 

About  an  hour  later,  Calvin  Schomburg,  a  Johnson  Space  Center  engineer  with  close  connections 
to  Shuttle  management,  sent  the  following  e-mail  to  other  Johnson  engineering  managers. 


— Original  Message — 

From:  SCHOMBURG,  CALVIN  (JSC-EA)  (NASA) 

Sent:  Tuesday,  January  21,  2003  9:26  AM 

To:  SHACK,  PAUL  E.  (JSC-EA42)  (NASA);  SERIALE-GRUSH,  JOYCE  M.  (JSC-EA)  (NASA);  HAMILTON,  DAVID  A. 

(DAVE)  (JSC-EA)  (NASA) 
Subject:  FW:  STS-107  Post-Launch  Film  Review  -  Day  1 


FYl-TPS  took  a  hit-should  not  be  a  problem-status  by  end  of  week. 


[Fyi=For  Your  Information,  TPS=Thermal  Protection  System] 


Shuttle  Program  managers  regarded  Schomburg  as  an  expert  on  the  Thermal  Protection  System. 
His  message  downplays  the  possibility  that  foam  damaged  the  Thermal  Protection  System. 
However,  the  Board  notes  that  Schomburg  was  not  an  expert  on  Reinforced  Carbon-Carbon 
(RCC).  which  initial  debris  analysis  indicated  the  foam  may  have  struck.  Because  neither 
Schomburg  nor  Shuttle  management  rigorously  differentiated  between  tiles  and  RCC  panels, 
the  bounds  of  Schomburg's  expertise  were  never  properly  qualified  or  questioned. 

Seven  minutes  later,  Paul  Shack,  Manager  of  the  Shuttle  Engineering  Office.  Johnson  Engineer- 
ing Directorate,  e-mailed  to  Rocha  and  other  Johnson  engineering  managers  information  on 
how  previous  bipod  ramp  foam  losses  were  handled. 

Original  Message 

From:  SHACK,  PAUL  E.  (JSC-EA42)  (NASA) 

Sent:  Tuesday,  January  21,  2003  9:33  AM 

To:  ROCHA,  ALAN  R.  (RODNEY)  (JSC-ES2)  (NASA);  SERIALE-GRUSH,  JOYCE  M.  (JSC-EA)  (NASA) 

Cc:  KRAMER,  JULIE  A.  (JSC-EA4)  (NASA);  MILLER,  GLENN  J.  (JSC-EA)  (NASA);  RICKMAN,  STEVEN  L.  (JSC-ES3) 

(NASA);  MADDEN,  CHRISTOPHER  B.  (CHRIS)  (JSC-ES3)  (NASA) 
Subject:  RE:  STS-107  Debris  Analysis  Team  Plans 

This  reminded  me  that  at  the  STS-113  FRR  the  ET  Project  reported  on  foam  loss  from  the  Bipod 
Ramp  during  STS-112.  The  foam  (estimated  4X5X12  inches)  impacted  the  ET  Attach  Ring  and 
dented  an  SRB  electronics  box  cover. 

Their  charts  stated  "ET  TPS  foam  loss  over  the  life  of  the  Shuttle  program  has  never  been  a  'Safety  of 
Flight'  issue".  They  were  severely  wire  brushed  over  this  and  Brian  O'Connor  (Associate  Administra- 
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tor  for  Safety)  asked  for  a  hazard  assessment  for  loss  of  foam. 


The  suspected  cause  for  foam  loss  is  trapped  air  pockets  which  expand  due  to  altitude  and  aerother- 
mal  heating. 


{FRR=Flighi  Readinesi  Review,  ET=Exferno/  Tank,  SRB=So{id  Rocket  Booster,  TPS=Thermal  Protection  System] 


Shack's  message  informed  Rocha  that  during  the  STS-1 13  Flight  Readiness  Review,  foam  loss 
was  not  considered  to  be  a  safety-of-flight  issue.  The  "wirebrushing"  that  the  External  Tank 
Project  received  for  stating  tiiat  foam  loss  has  "never  been  a  "Safety  of  Flight"  issue"  refers  to 
the  wording  used  to  justify  continuing  to  fly.  Officials  at  the  Flight  Readiness  Review  insisted 
on  classifying  the  foam  loss  as  an  "accepted  risk"  rather  than  "not  a  safety-of-flight  problem" 
to  indicate  that  although  the  Shuttle  would  continue  to  fly,  the  threat  posed  by  foam  is  not  zero 
but  rather  a  known  and  acceptable  risk. 

It  is  here  that  the  decision  to  fly  before  resolving  the  foam  problem  at  the  STS-1  13  Flight 
Readiness  Review  influences  decisions  made  during  STS-i07.  Having  at  hand  a  previously 
accepted  rationale  -  reached  just  one  mission  ago  -  that  foam  strikes  are  not  a  safety-of-flight 
issue  provides  a  strong  incentive  for  Mission  managers  and  working  engineers  to  use  that 
same  judgment  for  STS-1 07.  If  managers  and  engineers  were  to  argue  that  foam  strikes  are 
a  safety-of-flight  issue,  they  would  contradict  an  established  consensus  that  was  a  product  of 
the  Shuttle  Program's  most  rigorous  review  -  a  review  in  which  many  of  them  were  active 
participants. 

An  entry  in  a  Mission  Evaluation  Room  console  log  included  a  10:30  a.m.  report  that  compared 
the  STS-1 07  foam  loss  to  previous  foam  losses  and  subsequent  tile  damage,  which  reinforced 
management  acceptance  about  foam  strikes  by  indicating  that  the  foam  strike  appeared  to  be 
more  of  an  "in-family"  event. 

'■...STS-107  debris  measured  at  22"  \on^  +/-  10".  On  STS-1 12  the  debris  spray  pattern 
was  a  lot  smaller  than  that  of  STS-107.  On  STS-50  debris  that  was  determined  to  be  the 
Bipod  ramp  which  nwasured  26  "  x  10 "  caused  danu(,i;e  to  the  left  wint^. .  .to  J  tile  and  20% 
of  the  adjacent  tile.  Same  event  occurred  on  STS-7  [no  data  available). " 

Missed  Opportunity  3 

The  foam  strike  to  STS-107  was  mentioned  by  a  speaker  at  an  unrelated  meeting  of  NASA 
Headquarters  and  National  Imagery  and  Mapping  Agency  personnel,  who  then  discussed  a 
possible  NASA  request  for  Department  of  Defense  imagery  support.  However,  no  action  was 
taken. 

Imagery  Request  2 

Responding  to  concerns  from  his  employees  who  were  participating  in  the  Debris  Assessment 
Team,  United  Space  Alliance  manager  Bob  White  called  Lambert  Austin  on  Flight  Day  Six 
to  ask  what  it  would  take  to  get  imagery  of  Columbia  on  orbit.  They  discus.sed  the  analytical 
debris  damage  work  plan,  as  well  as  the  belief  of  some  integration  team  members  that  such 
imaging  might  be  beneficial. 

Austin  subsequently  telephoned  the  Department  of  Defense  Manned  Space  Flight  Support  Of- 
fice representative  to  ask  about  actions  necessary  to  get  imagery  of  Columbia  on  orbit.  Austin 
emphasized  that  this  was  merely  information  gathering,  not  a  request  for  action.  This  call  indi- 
cates that  Austin  was  unfamiliar  with  NASA/National  Imagery  and  Mapping  Agency  imagery 
request  procedures. 

An  e-mail  that  Lieutenant  Colonel  Timothy  Lee  sent  to  Don  McCormack  the  following  day 
shows  that  the  Defense  Department  had  begun  to  implement  Austin's  request. 
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Original  Message 

From:  LEE,  TIMOTHY  F,  LTCOL.  (JSC-MT)  (USAF) 

Sent:  Wednesday,  January  22,  2003  9:01  AM 

To:  MCCORMACK,  DONALD  L.  (DON)  (JSC-MV6)  (NASA) 

Subject:  NASA  request  for  DOD 

Don, 

FYI:  Lambert  Austin  called  me  yesterday  requesting  DOD  photo  support  for  STS-107.  Specifically,  he 
is  asking  us  if  we  have  a  ground  or  satellite  asset  that  can  take  a  high  resolution  photo  of  the  shuttle 
while  on-orbit--to  see  if  there  is  any  FOD  damage  on  the  wing.  We  are  working  his  request. 

Tim 


fDOD=Deparffnenf  of  Defense,  FOD=Foreign  Ob;ecf  Debris] 


At  the  same  time,  managers  Ralph  Roe,  Lambert  Austin,  and  Linda  Ham  referred  to  conversa- 
tions with  Cal\  in  Schomburg.  whom  they  referred  to  as  a  Thermal  Protection  System  "expert." 
They  indicated  that  Schomburg  had  advised  that  any  tile  damage  should  be  considered  a  turn- 
around maintenance  concern  and  not  a  safety-of-flight  issue,  and  that  imagery  of  Coliimhia's 
left  wing  was  not  necessary.  There  was  no  discussion  of  potential  RCC  damage. 

First  Debris  Assessment  Team  Meeting 

On  Flight  Day  Six.  the  Debris  Assessment  Team  held  its  first  formal  meeting  to  finalize  Orbiter 
damage  estimates  and  their  potential  consequences.  Some  participants  joined  the  proceedings 
via  conference  call. 

Imagery  Request  3 

After  two  hours  of  discussing  the  Crater  results  and  the  need  to  learn  precisely  where  the  debris 
had  hit  Coliiiiihici.  the  Debris  Assessment  Team  assigned  its  NASA  Co-Chair,  Rodney  Rocha, 
to  pursue  a  request  for  imagery  of  the  vehicle  on-orbit.  Each  team  member  supported  the  idea 
to  seek  imagery  from  an  outside  source.  Rather  than  working  the  request  up  the  usual  mission 
chain  of  command  through  the  Mission  Evaluation  Room  to  the  Mission  Management  Team  to 
the  Flight  Dynamics  Officer,  the  Debris  Assessment  Team  agreed,  largely  due  to  a  lack  of  par- 
ticipation by  Mission  Management  Team  and  Mission  Evaluation  Room  managers,  that  Rocha 
would  pursue  the  request  through  his  division,  the  Engineering  Directorate  at  Johnson  Space 
Center.  Rocha  sent  the  following  e-mail  to  Paul  Shack  shortly  after  the  meeting  adjourned. 

— Original  Message K 

From:  ROCHA,  ALAN  R.  (RODNEY)  (JSC-ES2)  (NASA)  | 

Sent:  Tuesday,  January  21,  2003  4:41  PM 

To:  SHACK,  PAUL  E.  (JSC-EA42)  (NASA);  HAMILTON,  DAVID  A.  (DAVE)  (JSC-EA)  (NASA);  MILLER,  GLENN  J.  (JSC- 

EA) (NASA) 
Cc:  SERIALE-GRUSH,  JOYCE  M.  (JSC-EA)  (NASA);  ROGERS,  JOSEPH  E.  (JOE)  (JSC-ES2)  (NASA);  GALBREATH, 

GREGORY  R  (GREG)  (JSC-ES2)  (NASA) 
Subject:  STS-107  Wing  Debris  Impact,  Request  for  Outside  Photo-Imaging  Help 

Paul  and  Dave, 

The  meeting  participants  (Boeing,  USA,  NASA  ES2  and  ESS,  KSC)  all  agreed  we  will  always  have 
big  uncertainties  in  any  transport/trajectory  analyses  and  applicability/extrapolation  of  the  old  Arc-Jet 
test  data  until  we  get  definitive,  better,  clearer  photos  of  the  wing  and  body  underside.  Without  better 
images  it  will  be  very  difficult  to  even  bound  the  problem  and  initialize  thermal,  trajectory,  and  struc- 
tural analyses.  Their  answers  may  have  a  wide  spread  ranging  from  acceptable  to  not-acceptable  to 
horrible,  and  no  way  to  reduce  uncertainty.  Thus,  giving  MOD  options  for  entry  will  be  very  difficult. 
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Can  we  petition  (beg)  for  outside  agency  assistance?  We  are  asking  for  Frank  Benz  with  Ralph  Roe 
or  Ron  Dittemore  to  ask  for  such.  Some  of  the  old  timers  here  remember  we  got  such  help  in  the  early 
1980's  when  we  had  missing  tile  concerns. 

Despite  some  nay-sayers,  there  are  some  options  for  the  team  to  talk  about:  On-orbit  thermal  condi- 
tioning for  the  major  structure  (but  is  in  contradiction  with  tire  pressure  temp,  cold  limits),  limiting  high 
cross-range  de-orbit  entries,  constraining  hght  or  left  had  turns  during  the  Heading  Alignment  Circle 
(only  if  there  is  struc.  damage  to  the  RCC  panels  to  the  extent  it  affects  flight  control. 

Rodney  Rocha 

Structural  Engineering  Division  (ES-SED) 

•  ES  Div.  Chief  Engineer  (Space  Shuttle  DOE) 

•  Chair,  Space  Shuttle  Loads  &  Dynamics  Panel 

Mail  Code  ES2 


fUSA=Un/fed  Space  A/liance,  NASA  ES2,  ES3=seporofe  divisions  of  f/ie  Johnson  Space  Cenfer  Engineering  Direcforafe, 
KSC=Kennedy  Space  Cenfer,  MOD=A/)issions  Operafions  Direcforofe,  or  Mission  Confro/J 


Routing  the  request  through  the  Engineering  department  led  in  part  to  it  being  viewed  by  Shuttle 
Program  managers  as  a  non-critical  engineering  desire  rather  than  a  critical  operational  need. 

Flight  Day  Seven,  Wednesday,  January  22,  2003 

Conversations  and  log  entries  on  Flight  Day  Seven  document  how  three  requests  for  images 
(Bob  Page  to  Wayne  Hale,  Bob  White  to  Lambert  Austin,  and  Rodney  Rocha  to  Paul  Shack) 
were  ultimately  dismissed  by  the  Mission  Management  Team,  and  how  the  order  to  halt  those 
requests  was  then  interpreted  by  the  Debris  Assessment  Team  as  a  direct  and  final  denial  of  their 
request  for  imagery. 

Missed  Opportunity  4 

On  the  morning  of  Flight  Day  Seven,  Wayne  Hale  responded  to  the  earlier  Flight  Day  Two  re- 
quest from  Bob  Page  and  a  call  from  Lambert  Austin  on  Flight  Day  Five,  during  which  Austin 
mentioned  that  "some  analysts"  from  the  Debris  Assessment  Team  were  interested  in  getting 
imagery.  Hale  called  a  Department  of  Defense  representative  at  Kennedy  Space  Center  (who 
was  not  the  designated  Department  of  Defense  official  for  coordinating  imagery  requests)  and 
asked  that  the  military  start  the  planning  process  for  imaging  Columbia  on  orbit. 

Within  an  hour,  the  Defense  Department  representative  at  NASA  contacted  U.S.  Strategic 
Command  (USSTRATCOM)  at  Colorado's  Cheyenne  Mountain  Air  Force  Station  and  asked 
what  it  would  take  to  get  imagery  of  Columliia  on  orbit.  (This  call  was  similar  to  Austin's  call 
to  the  Department  of  Defense  Manned  Space  Flight  Support  Office  in  that  the  caller  character- 
ized it  as  "information  gathering"  rather  than  a  request  for  action.)  A  representative  from  the 
USSTRATCOM  Plans  Ofhce  initiated  actions  to  identify  ground-based  and  other  imaging  as- 
sets that  could  execute  the  request. 

Hale's  earlier  call  to  the  Defense  Department  representative  at  Kennedy  Space  Center  was 
placed  without  authorization  from  Mission  Management  Team  Chair  Linda  Ham.  Also,  the  call 
was  made  to  a  Department  of  Defense  Representative  who  was  not  the  designated  liaison  for 
handling  such  requests.  In  order  to  initiate  the  imager)'  request  through  official  channels.  Hale 
also  called  Phil  Engelauf  at  the  Mission  Operations  Directorate,  told  him  he  had  started  Defense 
Department  action,  and  asked  if  Engelauf  could  have  the  Flight  Dynamics  Officer  at  Johnson 
Space  Center  make  an  official  request  to  the  Cheyenne  Mountain  Operations  Center.  Engelauf 
started  to  comply  with  Hale's  request. 
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After  the  Department  of  Defense  representatives  were  called,  Lambert  Austin  telephoned  Linda 
Ham  to  inform  her  about  the  imagery  requests  that  he  and  Hale  had  initiated.  Austin  also  told 
Wayne  Hale  that  he  had  asked  Lieutenant  Colonel  Lee  at  the  Department  of  Defense  Manned 
Space  Flight  Support  Office  about  what  actions  were  necessary  to  get  on-orbit  imagei^. 

Missed  Opportunities  5  and  6 

Mike  Card,  a  NASA  Headquarters  manager  from  the  Safety  and  Mission  Assurance  Office, 
called  Mark  Erminger  at  the  Johnson  Space  Center  Safety  and  Mission  Assurance  for  Shuttle 
Safety  Program  and  Bryan  O'Connor.  Associate  Administrator  for  Safety  and  Mission  Assur- 
ance, to  discuss  a  potential  Department  of  Defense  imaging  request.  Erminger  said  that  he  was 
told  this  was  an  "in-family"  event.  O'Connor  stated  he  would  defer  to  Shuttle  management  in 
handling  such  a  request.  Despite  two  safety  officials  being  contacted,  one  of  whom  was  NASA's 
highest-ranking  safety  official,  safety  personnel  took  no  actions  to  obtain  imagery. 

The  following  is  an  8:09  a.m.  entry  in  the  Mission  Evaluation  Room  Console  log. 

"We  received  a  visit  from  Mission  Manager/Vanessa  Ellerlw  and  FD  Office/ Pliil  Engekuif 
regarding  two  items:  ( I )  the  MMT's  action  item  to  the  MER  to  determine  the  impacts  to  the 
vehicle 's  150  Ihs  of  additional  weight. .  .and  (2)  Mr  Engelauf  wants  to  know  who  is  request- 
ing the  Air  Force  to  look  at  the  vehicle.  "  [FD=Flight  Director,  MMT=Mission  Management  Team, 
MER=Mission  Evaluation  Room] 

Cancellation  of  the  Request  for  Imagery 

At  8:30  a.m..  the  NASA  Department  of  Defense  liaison  officer  called  USSTRATCOM  and  can- 
celled the  request  for  imagery.  The  reason  given  for  the  cancellation  was  that  NASA  had  identi- 
fied its  own  in-house  resources  and  no  longer  needed  the  military's  help.  The  NASA  request  to 
the  Department  of  Defense  to  prepare  to  image  Columbia  on-orbit  was  both  made  and  rescinded 
within  90  minutes. 

The  Board  has  determined  that  the  following  sequence  of  events  likely  occurred  within  that  90- 
minute  period.  Linda  Ham  asked  Lambert  Austin  if  he  knew  who  was  requesting  the  imagery. 
After  admitting  his  participation  in  helping  to  make  the  imagery  request  outside  the  official 
chain  of  command  and  without  first  gaining  Ham's  permission,  Austin  referred  to  his  conver- 
sation with  United  Space  Alliance  Shuttle  Integration  manager  Bob  White  on  Flight  Day  Six, 
in  which  White  had  asked  Austin,  in  response  to  White's  Debris  Assessment  Team  employee 
concerns,  what  it  would  take  to  get  Orbiter  imagery. 

Even  though  Austin  had  already  informed  Ham  of  the  request  for  imagery,  Ham  later  called 
Mission  Management  Team  members  Ralph  Roe,  Manager  of  the  Space  Shuttle  Vehicle  En- 
gineering Office,  Loren  Shriver,  United  Space  Alliance  Deputy  Program  Manager  for  Shuttle, 
and  David  Moyer,  the  on-duty  Mission  Evaluation  Room  manager,  to  determine  the  origin  of 
the  request  and  to  confirm  that  there  was  a  "requirement"  for  a  request.  Ham  also  asked  Flight 
Director  Phil  Engelauf  if  he  had  a  "requirement"  for  imagery  of  Columbia's  left  wing.  These 
individuals  all  stated  that  they  had  not  requested  imagery,  were  not  aware  of  any  "official" 
requests  for  imagery,  and  could  not  identify  a  "requirement"  for  imagery.  Linda  Ham  later  told 
several  individuals  that  nobody  had  a  requirement  for  imagery. 

What  started  as  a  request  by  the  Intercenter  Photo  Working  Group  to  seek  outside  help  in  ob- 
taining images  on  Flight  Day  Two  in  anticipation  of  analysts'  needs  had  become  by  Flight  Day 
Six  an  actual  engineering  request  by  members  of  the  Debris  Assessment  Team,  made  informally 
through  Bob  White  to  Lambert  Austin,  and  formally  in  Rodney  Rocha's  e-mail  to  Paul  Shack. 
These  requests  had  then  caused  Lambert  Austin  and  Wayne  Hale  to  contact  Department  of 
Defense  representatives.  When  Ham  officially  terminated  the  actions  that  the  Department 
of  Defense  had  begun,  she  effectively  terminated  both  the  Intercenter  Photo  Working  Group 
request  and  the  Debris  Assessment  Team  request.  While  Ham  has  publicly  stated  she  did  not 
know  of  the  Debris  Assessment  Team  members'  desire  for  imagery,  she  never  asked  them  di- 
rectly if  the  request  was  theirs,  even  though  they  were  the  team  analyzing  the  foam  strike. 

Also  on  Flight  Day  Seven,  Ham  raised  concerns  that  the  extra  time  spent  maneuvering  Columbia 
to  make  the  left  wing  visible  for  imaging  would  unduly  impact  the  mission  schedule;  for  ex- 
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ample,  science  experiments  would  have  to  stop  while  the  imagery  was  taken.  According  to 
personal  notes  obtained  by  the  Board: 

"Linda  Ham  said  it  was  no  l<nii>er  hcini;  pursued  since  even  if  we  saw  something,  we 
coiildn  't  do  (diytliini;  about  it.  The  Proi^ram  dichi  't  want  to  spend  the  resources. " 

Shuttle  managers,  including  Ham,  also  said  they  were  looking  for  very  small  areas  on  the  Or- 
biter  and  that  past  imagery  resolution  was  not  very  good.  The  Board  notes  that  no  individuals  in 
the  STS- 107  operational  chain  of  command  had  the  security  clearance  necessary  to  know  about 
National  imaging  capabilities.  Additionally,  no  evidence  has  been  uncovered  that  anyone  from 
NASA,  United  Space  Alliance,  or  Boeing  .sought  to  determine  the  expected  quality  of  images 
and  the  difficulty  and  costs  of  obtaining  Department  of  Defense  assistance.  Therefore,  members 
of  the  Mission  Management  Team  were  making  critical  decisions  about  imagery  capabilities 
based  on  little  or  no  knowledge. 

The  following  is  an  entry  in  the  Flight  Director  Handover  Log. 

'•NASA  Resident  Office,  Peterson  AFB  called  and  SOI  at  USSPACECOM  was  officially 
turned  off.  This  went  all  the  way  up  to  4  star  General.  Post  flight  we  will  write  a  memo  to 
USSPACECOM  telling  them  whom  they  .should  take  SOI  requests  from."""  lAFB=Air  Force 
Base,  SO/=Spacecroff  Object  IdentiFicafion,  USSPACECOM=U.S.  Space  Command] 

After  canceling  the  Department  of  Defense  imagery  request,  Linda  Ham  continued  to  explore 
whether  foam  strikes  posed  a  safety  of  flight  issue.  She  sent  an  e-mail  to  Lambert  Austin  and 
Ralph  Roe. 


Original  Message— 

From:               HAM,  LINDA  J.  (JSC-MA2)  (NASA) 
Sent:               Wednesday,  January  22,  2003  9:33  AM 
To:                    AUSTIN,  LAMBERT  D.  (JSC-MS)  (NASA);  ROE, 
Subject:          ET  Foam  Loss 

RALPH  R. 

(JSC-MV)  (NASA) 

Can  we 
the  den 

say  that  for  any 
sity? 

ET  foam  lost,  no  'safety  of  flight'  damage  can  occur 

to  the  Orbiter  because 

of 

[ET=Extemal  Tank] 

Responses  included  the  following. 


Original  Message 

From:  ROE,  RALPH  R.  (JSC-MV)  (NASA) 

Sent:  Wednesday,  January  22,  2003  9:38  AM 

To:  SCHOMBURG,  CALVIN  (JSC-EA)  (NASA) 

Subject:  FW:  ET  Foam  Loss 

Calvin, 

1  wouldn't  think  we  could  make  such  a  generic  statement  but  can  we  bound  it  some  how  by  size  or 
acreage? 


[Acreoge=larger  areas  of  foam  coverage^ 


Ron  Dittermore  e-mailed  Linda  Ham  the  following. 
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Original  Message 

From:  DITTEMORE,  RONALD  D.  (JSC-MA)  (NASA) 
Sent:  Wednesday,  January  22,  2003  10:15  AM 
To:  HAM,  LINDA  J.  (JSC-MA2)  (NASA) 
Subject:  RE:  ET  Briefing  -  STS-112  Foam  Loss 

Another  thought,  we  need  to  make  sure  that  the  density  of  the  ET  foam  cannot  damage  the  tile  to 
where  it  is  an  impact  to  the  orbiter... Lambert  and  Ralph  need  to  get  some  folks  working  with  ET. 


The  following  is  an  e-mail  from  Calvin  Schombiirg  to  Ralph  Roe. 


Original  Message 

From:  SCHOMBURG,  CALVIN  (JSC-EA)  (NASA) 

Sent:  Wednesday,  January  22,  2003  10:53  AM 

To:  ROE,  RALPH  R.  (JSC-MV)  (NASA) 

Subject:  RE:  ET  Foam  Loss 

No-the  amount  of  damage  ET  foam  can  cause  to  the  TPS  material-tiles  is  based  on  the  amount  of 
impact  energy-the  size  of  the  piece  and  its  velocity(  from  just  after  pad  clear  until  about  120  seconds- 
after  that  it  will  not  hit  or  it  will  not  enough  energy  to  cause  any  damage)-it  is  a  pure  kinetic  problem- 
there  is  a  size  that  can  cause  enough  damage  to  a  tile  that  enough  of  the  material  is  lost  that  we 
could  burn  a  hole  through  the  skin  and  have  a  bad  day-(loss  of  vehicle  and  crew  -about  200-400  tile 
locations(  out  of  the  23,000  on  the  lower  surface )-the  foam  usually  fails  in  small  popcorn  pieces-that 
is  why  it  is  vented-to  make  small  hits-the  two  or  three  times  we  have  been  hit  with  a  piece  as  large 
as  the  one  this  flight-we  got  a  gouge  about  8-10  inches  long  about  2  inches  wide  and  3/4  to  an  1  inch 
deep  across  two  or  three  tiles.  That  is  what  I  expect  this  time-nothing  worst.  If  that  is  all  we  get  we 
have  have  no  problem-will  have  to  replace  a  couple  of  tiles  but  nothing  else. 


[ET=External  Tank,  TPS=Tbermal  Profection  System] 


The  following  is  a  response  from  Lambert  Austin  to  Linda  Ham. 


Original  Message 

From:  AUSTIN,  LAMBERT  D.  (JSC-MS)  (NASA) 

Sent:  Wednesday,  January  22,  2003  3:22  PM 

To:  HAM,  LINDA  J.  (JSC-MA2)  (NASA) 

Cc:  WALLACE,  RODNEY  0.  (ROD)  (JSC-MS2)  (NASA);  NOAH,  DONALD  S.  (DON)  (JSC-MS)  (NASA) 

Subject:  RE:  ET  Foam  Loss 

NO.  I  will  cover  some  of  the  pertinent  rationale. ...there  could  be  more  if  I  spent  more  time  thinking 
about  it.  Recall  this  issue  has  been  discussed  from  time  to  time  since  the  inception  of  the  basic  "no 
debris"  requirement  in  Vol.  X  and  at  each  review  the  SSP  has  concluded  that  it  is  not  possible  to 
PRECLUDE  a  potential  catastrophic  event  as  a  result  of  debris  impact  damage  to  the  flight  elements. 
As  regards  the  Orbiter,  both  windows  and  tiles  are  areas  of  concern. 

You  can  talk  to  Cal  Schomberg  and  he  will  verify  the  many  times  we  have  covered  this  in  SSP 
reviews.  While  there  is  much  tolerance  to  window  and  tile  damage,  ET  foam  loss  can  result  in  im- 
pact damage  that  under  subsequent  entry  environments  can  lead  to  loss  of  structural  integrity  of  the 
Orbiter  area  impacted  or  a  penetration  in  a  critical  function  area  that  results  in  loss  of  that  function. 
My  recollection  of  the  most  critical  Orbiter  bottom  acreage  areas  are  the  wing  spar,  main  landing  gear 
door  seal  and  RCC  panels. ..of  course  Cal  can  give  you  a  much  better  rundown. 

We  can  and  have  generated  parametric  impact  zone  characterizations  for  many  areas  of  the  Orbiter 
for  a  few  of  our  more  typical  ET  foam  loss  areas.  Of  course,  the  impact/damage  significance  is  always 
a  function  of  debrir  size  and  density,  impact  velocity,  and  impact  angle-these  latter  2  being  a  function 
of  the  flight  time  at  which  the  ET  foam  becomes  debris.  For  STS-107  specifically,  we  have  generated 

[continued  on  next  pcii^e] 
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[continued  from  previous  pa}>e] 

this  info  and  provided  it  to  Orbiter.  Of  course,  even  this  is  based  on  the  ASSUMPTION  that  the  loca- 
tion and  size  of  the  debris  is  the  same  as  occurred  on  STS-112 this  cannot  be  verified  until  we 

receive  the  on-board  ET  separation  photo  evidence  post  Orbiter  landing.  We  are  requesting  that  this 
be  expedited.  I  have  the  STS-107  Orbiter  innpact  map  based  on  the  assumptions  noted  herein  being 
sent  down  to  you.  Rod  is  in  a  review  with  Orbiter  on  this  info  right  now. 


[SSP-Space  Sf)utf/e  Program,  Er=Exferna/  Tank] 


The  Board  notes  that  these  e-mail  exchanges  indicate  that  senior  Mission  Management  Team 
managers,  including  the  Shuttle  Program  Manager.  Mission  Management  Team  Chair,  head  of 
Space  Shuttle  Systems  Integration,  and  a  Shuttle  tile  expert,  correctly  identified  the  technical 
bounds  of  the  foam  strike  problem  and  its  potential  seriousness.  Mission  managers  understood 
that  the  relevant  question  was  not  whether  foam  posed  a  safcty-of- flight  issue  -  it  did  -  but 
rather  whether  the  observed  foam  strike  contained  sufficient  kinetic  energy  to  cause  damage 
that  could  lead  to  a  burn-through.  Here,  all  the  key  managers  were  asking  the  right  question 
and  admitting  the  danger.  They  even  identified  RCC  as  a  critical  impact  zone.  Yet  little  follow- 
through  occurred  with  either  the  request  for  imagery  or  the  Debris  Assessment  Team  analysis. 
(See  Section  3.4  and  3.6  for  details  on  the  kinetics  of  foam  strikes.) 

A  Mission  Evaluation  Room  log  entry  at  10:37  a.m.  records  the  decision  not  to  seek  imaging 
of  Coliinihia's  left  wing. 

"USA  Prof;rani  Mwntiier/Loren  Sliriver.  NASA  Manager,  Program  Integration/ Linda  Ham, 
&  NASA  SSVEO/Ralph  Roe  have  stated  that  there  is  no  need  for  the  Air  Force  to  take  a  look 
at  the  vehicle."  [USA=United  Space  Alliance,  SSVEO=Space  Shuttle  Vehicle  Engineering  Office] 

At  1 1  ;22  a.m..  Debris  Assessment  Team  Co-Chair  Pam  Madera  sent  an  e-mail  to  team  members 
setting  the  agenda  for  the  team's  second  formal  meeting  that  afternoon  that  included: 

"...  Discussion  on  Need/Rationale  for  Mandatory  Viewing  ff  damage  site  (All)..." 

Earlier  e-mail  agenda  wording  did  not  include  "Need/Rationale  for  Mandatory"  wording  as 
listecj  here,  which  indicates  that  Madera  knew  of  management's  decision  to  not  seek  images  of 
Columbia 's  left  wing  and  anticipated  having  to  articulate  a  "mandatory"  rationale  to  reverse  that 
decision.  In  fact,  a  United  Space  Alliance  manager  had  informed  Madera  that  imagery  would  be 
sought  only  if  the  request  was  a  "mandatory  need."  Twenty-three  minutes  later,  an  e-mail  from 
Paul  Shack  to  Rodney  Rocha,  who  the  day  before  had  carried  forward  the  Debris  Assessment 
Team's  request  for  imaging,  stated  the  following. 

". . .  FYl.  According  to  the  MER,  Ralph  Roe  has  told  program  that  Orbiter  is  not  requesting 
any  outside  imaging  help  ..."  [MER=Mission  Evaluation  Room] 

Earlier  that  morning,  Ralph  Roe's  deputy  manager,  Trish  Petite,  had  separate  conversations 
with  Paul  Shack  and  tile  expert  Calvin  Schomburg.  In  those  conversations.  Petite  noted  that 
an  analysis  of  potential  damage  was  in  progress,  and  they  should  wait  to  see  what  the  analysis 
showed  before  asking  for  imagery.  Schomburg,  though  aware  of  the  Debris  Assessment  Team's 
request  for  imaging,  told  Shack  and  Petite  that  he  believed  on-orbit  imaging  of  potentially  dam- 
aged areas  was  not  necessary. 

As  the  moming  wore  on.  Debris  Assessment  Team  engineers.  Shuttle  Program  management, 
and  other  NASA  personnel  exchanged  e-mail.  Most  messages  centered  on  technical  matters 
to  be  discussed  at  the  Debris  Assessment  Team's  afternoon  meeting,  including  debris  density, 
computer-aided  design  models,  and  the  highest  angle  of  incidence  to  use  for  a  particular  mate- 
rial property.  One  e-mail  from  Rocha  to  his  managers  and  other  Johnson  engineers  at  11:19 
a.m.,  included  the  following. 

". . .  there  are  good  scenarios  (acceptable  and  minimal  damage)  to  horrible  ones,  depend- 
ing on  the  extent  of  the  damage  incurred  by  the  wing  and  location.  The  most  critical  loca- 
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rions  seem  to  he  the  1191  witi}^  spar  region,  the  main  hmding  gear  door  seal,  and  the  RCC 
panels.  We  do  not  know  yet  the  exact  extent  or  nature  of  the  damage  without  being  provided 
better  images,  and  without  such  all  the  high  powered  analyses  and  as.sessments  in  work 
will  retain  significant  uncertainties  ..." 

Second  Debris  Assessment  Team  Meeting 

Some  but  not  all  of  the  engineers  attending  the  Debris  Assessment  Team's  second  meeting  had 
learned  that  the  Shuttle  Program  was  not  pursuing  imaging  of  potentially  damaged  areas.  What 
team  members  did  not  realize  was  the  Shuttle  Program's  decision  not  to  seek  on-orbit  imagery 
was  not  necessarily  a  direct  and  final  response  to  their  request.  Rather,  the  "no"  was  partly  in 
response  to  the  Kennedy  Space  Center  action  initiated  by  United  Space  Alliance  engineers  and 
managers  and  finally  by  Wayne  Hale. 

Not  knowing  that  this  was  the  case.  Debris  Assessment  Team  members  speculated  as  to  why 
their  request  was  rejected  and  whether  their  analysis  was  worth  pursuing  without  new  imagery. 
Discussion  then  moved  on  to  whether  the  Debris  Assessment  Team  had  a  "mandatory  need"  for 
Department  of  Defense  imaging.  Most  team  members,  when  asked  by  the  Board  what  "manda- 
tory need"  meant,  replied  with  a  shrug  of  their  shoulders.  They  believed  the  need  for  imagery 
was  obvious:  without  better  pictures,  engineers  would  be  unable  to  make  reliable  predictions  of 
the  depth  and  area  of  damage  caused  by  a  foam  strike  that  was  outside  of  the  experience  base. 
However,  team  members  concluded  that  although  their  need  was  important,  they  could  not  cite 
a  "mandatory"  requirement  for  the  request.  Analysts  on  the  Debris  Assessment  Team  were  in  the 
unenviable  position  of  wanting  images  to  more  accurately  assess  damage  while  simultaneously 
needing  to  prove  to  Program  managers,  as  a  result  of  their  asses.sment.  that  there  was  a  need 
for  images  in  the  first  place. 

After  the  meeting  adjourned.  Rocha  read  the  1 1 :45  a.m.  e-mail  from  Paul  Shack,  which  said  that 
the  Orbiter  Project  was  not  requesting  any  outside  imaging  help.  Rocha  called  Shack  to  ask  if 
Shack's  boss.  Johnson  Space  Center  engineering  director  Frank  Benz,  knew  about  the  request. 
Rocha  then  sent  several  e-mails  consisting  of  questions  about  the  ongoing  analyses  and  details 
on  the  Shuttle  Program's  cancellation  of  the  imaging  request.  An  e-mail  that  he  did  not  send  but 
instead  printed  out  and  shared  with  a  colleague  follows. 

"In  m\  humble  technical  opinion,  this  is  the  wrong  (and  bordering  on  irresponsible)  an- 
swer from  the  SSP  and  Orbiter  not  to  request  additional  imaging  help  from  any  outside 
source.  I  must  emphasize  (again)  that  severe  enough  damage  (3  or  4  multiple  tiles  knocked 
out  down  to  the  densification  layer)  combined  with  the  heating  and  re.mlting  damage  to  the 
underlying  .structure  at  the  most  critical  location  (viz..  MLG  door/wheels/tires/hydraulics 
or  the  XI 191  spar  cap)  could  present  potentially  grave  hazards.  The  engineering  team  will 
admit  it  might  not  achieve  definitive  high  confidence  answers  without  additional  images, 
but,  without  action  to  request  help  to  clarify  the  damage  visually,  we  will  guarantee  it  will 
not.  Can  we  talk  to  Frank  Benz  before  Friday 's  MMT?  Remember  the  NASA  safety  post- 
ers everywhere  around  stating.  'If  it's  not  safe,  say  so".'  Yes,  it's  that  serious."  [SSP^Space 
Shuttle  Program,  MLG=Main  Landing  Gear,  MA^T=Mission  /Management  Team] 

When  asked  why  he  did  not  send  this  e-mail,  Rocha  replied  that  he  did  not  want  to  jump  the 
chain  of  command.  Having  already  raised  the  need  to  have  the  Orbiter  imaged  with  Shack,  he 
would  defer  to  management's  judgment  on  obtaining  imagery. 

Even  after  the  imagery  request  had  been  cancelled  by  Program  management,  engineers  in  the 
Debris  Assessment  Team  and  Mission  Control  continued  to  analyze  the  foam  strike.  A  structural 
engineer  in  the  Mechanical,  Maintenance,  Arm  and  Crew  Systems  sent  an  e-mail  to  a  flight 
dynamics  engineer  that  stated: 

"There  is  lots  of  speculation  as  to  extent  of  the  damage,  and  we  could  get  a  burn  through 
into  the  wheel  well  upon  entry. " 

Less  than  an  hour  later,  at  6:09  p.m..  a  Mission  Evaluation  Room  Console  log  entry  stated  the 
following. 

"MMACS  is  trying  to  view  a  Quicktime  movie  on  the  debris  impact  but  doesn  V  have  Quick- 
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time  software  on  his  console.  He  needs  either  cm  avi,  mpei>  file  or  a  vhs  tape.  He  is  ciskini^ 
us  for  help.  "  [MMACS=Mechanical,  Mainfenance,  Arm  and  Crew  Systems] 

The  controller  at  the  Mechanical,  Maintenance,  Arm  and  Crew  Systems  console  would  be 
among  the  first  in  Mission  Control  to  see  indications  of  burn-through  during  Coliiinhia\  re-en- 
try on  the  morning  of  February  1.  This  log  entry  also  indicates  that  Mission  Control  personnel 
were  aware  of  the  strike. 

Flight  Day  Eight,  Thursday,  January  23,  2003 

The  morning  after  Shuttle  Program  Management  decided  not  to  pursue  on-orbit  imagery.  Rod- 
ney Rocha  received  a  return  call  from  Mission  Operations  Directorate  representative  Barbara 
Conte  to  discuss  what  kinds  of  imaging  capabilities  were  available  for  STS-107. 

Missed  Opportunity  7 

Conte  explained  to  Rocha  that  the  Mission  Operations  Directorate  at  Johnson  did  have  U.S. 
Air  Force  standard  services  for  imaging  the  Shuttle  during  Solid  Rocket  Booster  separation 
and  External  Tank  separation.  Conte  explained  that  the  Orbiter  would  probably  have  to  fly  over 
Hawaii  to  be  imaged.  The  Board  notes  that  this  statement  illustrates  an  unfamiliarity  with  Na- 
tional imaging  assets.  Hawaii  is  only  one  of  many  sites  where  relevant  assets  are  based.  Conte 
asked  Rocha  if  he  wanted  her  to  pursue  such  a  request  through  Missions  Operations  Directorate 
channels.  Rocha  said  no,  because  he  believed  Program  managers  would  still  have  to  support 
such  a  request.  Since  they  had  already  decided  that  imaging  of  potentially  damaged  areas  was 
not  necessary,  Rocha  thought  it  unlikely  that  the  Debris  Assessment  Team  could  convince  them 
otherwise  without  definitive  data. 

Later  that  day,  Conte  and  another  Mission  Operations  Directorate  representative  were  attending 
an  unrelated  meeting  with  Leroy  Cain,  the  STS-107  ascent/entry  Flight  Director.  At  that  meet- 
ing, they  conveyed  Rocha's  concern  to  Cain  and  offered  to  help  with  obtaining  imaging.  After 
checking  with  Phil  Engelauf,  Cain  distributed  the  following  e-mail. 


Original  Message 

From:  CAIN,  LEROY  E.  (JSC-DA8)  (NASA) 

Sent:  Thursday,  January  23,  2003  12:07  PM 

To:  JONES,  RICHARD  S.  (JSC-DM)  (NASA);  OLIVER,  GREGORY  T  (GREG)  (JSC-DM4)  (NASA);  CONTE,  BARBARA  A. 

(JSC-DM)  (NASA) 
Cc:  ENGELAUF,  PHILIP  L.  (JSC-DA8)  (NASA);  AUSTIN,  BRYAN  P.  (JSC-DA8)  (NASA);  BECK,  KELLY  B.  (JSC-DA8) 

(NASA);  HANLEY,  JEFFREY  M.  (JEFF)  (JSC-DA8)  (NASA);  STICH,  J.  S.  (STEVE)  (JSC-DA8)  (NASA) 
Subject:  Help  with  debris  hit 

The  SSP  was  asked  directly  if  they  had  any  interest/desire  in  requesting  resources  outside  of  NASA 
to  view  the  Orbiter  (ref.  the  wing  leading  edge  debris  concern). 

They  said,  No. 

After  talking  to  Phil,  I  consider  it  to  be  a  dead  issue. 


[SSP=Space  Shuttle  Program] 


Also  on  Flight  Day  Eight,  Debris  Assessment  Team  engineers  presented  their  final  debris  trajec- 
tory estimates  to  their  NASA,  United  Space  Alliance,  and  Boeing  managers.  These  estimates 
formed  the  basis  for  predicting  the  Orbiter's  damaged  areas  as  well  as  the  extent  of  damage, 
which  in  turn  determined  the  ultimate  threat  to  the  Orbiter  during  re-entry. 

Mission  Control  personnel  thought  they  should  tell  Commander  Rick  Husband  and  Pilot  Wil- 
liam McCool  about  the  debris  strike,  not  because  they  thought  that  it  was  worthy  of  the  crew's 
attention  but  because  the  crew  might  be  asked  about  it  in  an  upcoming  media  interview.  Flight 
Director  Steve  Stitch  sent  the  following  e-mail  to  Husband  and  McCool  and  copied  other  Flight 
Directors. 
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Original  Message 

From:  STICH,  J.  S.  (STEVE)  (JSC-DA8)  (NASA) 

Sent:  Thursday,  January  23,  2003  11:13  PM 

To:  CDR;  PLT 

Cc:  BECK,  KELLY  B.  (JSC-DA8)  (NASA);  ENGELAUF,  PHIUP  L.  (JSC-DA8)  (NASA);  CAIN,  LEROY  E.  (JSC-DA8) 

(NASA);  HANLEY,  JEFFREY  M.  (JEFF)  (JSC-DA8)  (NASA);  AUSTIN,  BRYAN  P.  (JSC-DA8)  (NASA) 
Subject:  INFO:  Possible  PAO  Event  Question 

Rick  and  Willie, 

You  guys  are  doing  a  fantastic  job  staying  on  the  timeline  and  accomplishing  great  science.  Keep  up 
the  good  work  and  let  us  know  if  there  is  anything  that  we  can  do  better  from  an  MCC/POCC  stand- 
point. 

There  is  one  item  that  I  would  like  to  make  you  aware  of  for  the  upcoming  PAO  event  on  Blue  FD 
10  and  for  future  PAO  events  later  in  the  mission.  This  item  is  not  even  worth  mentioning  other  than 
wanting  to  make  sure  that  you  are  not  surprised  by  it  in  a  question  from  a  reporter. 

During  ascent  at  approximately  80  seconds,  photo  analysis  shows  that  some  debris  from  the  area  of 
the  -Y  ET  Bipod  Attach  Point  came  loose  and  subsequently  impacted  the  orbiter  left  wing,  in  the  area 
of  transition  from  Chine  to  Main  Wing,  creating  a  shower  of  smaller  particles.  The  impact  appears 
to  be  totally  on  the  lower  surface  and  no  particles  are  seen  to  traverse  over  the  upper  surface  of  the 
wing.  Experts  have  reviewed  the  high  speed  photography  and  there  is  no  concern  for  RCC  or  tile 
damage.  We  have  seen  this  same  phenomenon  on  several  other  flights  and  there  is  absolutely  no 
concern  for  entry. 

That  is  all  for  now.  It's  a  pleasure  working  with  you  every  day. 


fMCC/POCC=Mission  Control  Center/Payload  Operations  Control  Center,  PAO=Pub/(c  Affairs  Officer,  FD  70=F/(g/)f  Day 
Ten,  -Y=left,  ET=External  Tank] 


This  e-mail  was  followed  by  another  to  the  crew  with  an  attachment  of  the  video  showing  the 
debris  impact.  Husband  acknowledged  receipt  of  these  messages. 

Later,  a  NASA  liaison  to  USSTRATCOM  sent  an  e-mail  thanking  personnel  for  the  prompt 
response  to  the  imagery  request.  The  e-mail  asked  that  they  help  NASA  observe  "official  chan- 
nels" for  this  type  of  support  in  the  future.  Excerpts  from  this  message  follow. 

"Let  me  assure  you  that,  as  of  yesterday  afternoon,  the  Shuttle  was  in  excellent  shape, 
mission  objectives  were  heinfi  performed,  and  that  there  were  no  major  debris  system 
problems  identified.  The  request  that  you  received  was  based  on  a  piece  of  debris,  most 
likely  ice  or  insulation  from  the  ET,  that  came  off  shortly  after  launch  and  hit  the  underside 
of  the  vehicle.  Even  thoui-h  this  is  not  a  common  occurrence  it  is  something  that  has  hap- 
pened before  and  is  not  considered  to  be  a  major  problem.  The  one  problem  that  this  has 
identified  is  the  need  for  some  additional  coordination  within  NASA  to  assure  that  when  a 
request  is  made  it  is  done  throuf^h  the  official  channels.  The  NASA/  USSTRAT  (USSPACE) 
MO  A  identifies  the  need  for  this  type  of  support  and  that  it  will  be  provided  by  USSTRAT. 
Procedures  have  been  loiiff  established  that  identifies  the  Flight  Dynamics  Officer  {for  the 
Shuttle)  and  the  Trajectory  Operations  Officer  (for  the  International  Space  Station)  as  the 
POCs  to  work  these  issues  with  the  personnel  in  Cheyenne  Mountain.  One  of  the  primary 
purposes  for  this  chain  is  to  make  sure  that  requests  like  this  one  does  not  slip  through  the 
system  and  spin  the  community  up  about  potential  problems  that  have  not  been  fully  vet- 
ted through  the  proper  channels.  Two  things  that  you  can  help  us  with  is  to  make  sure  that 
future  requests  of  this  sort  are  confirmed  through  the  proper  channels.  For  the  Shuttle  it 
is  via  CMOC  to  the  Flight  Dyiuimics  Officer.  For  the  International  Space  Station  it  is  via 
CMOC  to  the  Trajectory  Operations  Officer.  The  second  request  is  that  no  resources  are 
spent  unless  the  request  has  been  confirmed.  These  requests  are  not  meant  to  diminish  the 
responsibilities  of  the  DDMS  office  or  to  change  any  previous  agreements  but  to  eliminate 
the  confusion  that  can  be  caused  by  a  lack  of  proper  coordiiuition."  [ET=External  Tank, 
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MOA=Memorandum  of  Agreemenf,   POC=Poinf  of  Contact,   CMOC=Cheyenne  Mountain  Opera- 
tions Center,  DDMS=Department  of  Defense  Manned  Space  Fligfit  Support  Office] 

Third  Debris  Assessment  Team  Meeting 

The  Debris  Assessment  Team  met  for  the  third  time  Thursday  afternoon  to  review  updated 
impact  analyses.  Engineers  noted  that  there  were  no  alternate  re-entry  trajectories  that  the  Or- 
biter  could  fly  to  substantially  reduce  heating  in  the  general  area  of  the  foam  strike.  Engineers 
also  presented  final  debris  trajectory  data  that  included  three  debris  size  estimates  to  cover 
the  continuing  uncertainty  about  the  size  of  the  debris.  Team  members  were  told  that  imaging 
would  not  be  forthcoming.  In  the  face  of  this  denial,  the  team  discussed  whether  to  include  a 
presentation  slide  supporting  their  desire  for  images  of  the  potentially  damaged  area.  Many  still 
felt  it  was  a  valid  request  and  wanted  their  concerns  aired  at  the  upcoming  Mission  Evaluation 
Room  brief  and  then  at  the  Mission  Management  Team  level.  Eventually,  the  idea  of  including 
a  presentation  slide  about  the  imaging  request  was  dropped. 

Just  prior  to  attending  the  third  assessment  meeting,  tile  expert  Calvin  Schomburg  and  Rod- 
ney Rocha  met  to  discuss  foam  impacts  from  other  missions.  Schomburg  implied  that  the 
STS-107  foam  impact  was  in  the  Orbiter's  experience  base  and  represented  only  a  maintenance 
issue.  Rocha  disagreed  and  argued  about  the  potential  for  burn-through  on  re-enti^.  Calvin 
Schomburg  stated  a  belief  that  if  there  was  severe  damage  to  the  tiles,  "nothing  could  he  done. " 
(See  Section  6.4.)  Both  then  joined  the  meeting  already  in  progress. 

According  to  Boeing  analysts  who  were  members  of  the  Debris  Assessment  Team,  Schomburg 
called  to  ask  about  their  rationale  for  pursuing  imagery.  The  Boeing  analysts  told  him  that 
something  the  size  of  a  large  cooler  had  hit  the  Orbiter  at  500  miles  per  hour.  Pressed  for  ad- 
ditional reasons  and  not  fully  understanding  why  their  original  justification  was  insufficient, 
the  analysts  said  that  at  least  they  would  know  what  happened  if  something  were  to  go  terribly 
wrong.  The  Boeing  analysts  next  asked  why  they  were  working  so  hard  analyzing  potential 
damage  areas  if  Shuttle  Program  management  believed  the  damage  was  minor  and  that  no 
safety-of-flight  issues  existed.  Schomburg  replied  that  the  analysts  were  new  and  would  learn 
from  this  exercise. 

Flight  Day  Nine,  Friday,  January  24,  2003 

At  7:00  a.m.,  Boeing  and  United  Space  Alliance  contract  personnel  presented  the  Debris  As- 
sess/nent  Team's  findings  to  Don  McCormack.  the  Mission  Evaluation  Room  manager.  In  yet 
another  signal  that  working  engineers  and  mission  personnel  shared  a  high  level  of  concern  for 
Coliimhia'?,  condition,  so  many  engineers  crowded  the  briefing  room  that  it  was  standing  room 
only,  with  people  lining  the  hallway. 

The  presentation  included  viewgraphs  that  discussed  the  teain's  analytical  methodology  and 
five  scenarios  for  debris  damage,  each  based  on  different  estimates  of  debris  size  and  impact 
point.  A  sixth  scenario  had  not  yet  been  completed,  but  early  indications  suggested  that  it  would 
not  differ  significantly  from  the  other  five.  Each  case  was  presented  with  a  general  overview 
of  transport  mechanics,  results  from  the  Crater  modeling,  aerothermal  considerations,  and  pre- 
dicted thermal  and  structural  effects  for  Columbia  ^  re-entry.  The  briefing  focused  primarily  on 
potential  damage  to  the  tiles,  not  the  RCC  panels.  (An  analysis  of  how  the  poor  construction 
of  these  viewgraphs  effectively  minimized  key  assumptions  and  uncertainties  is  presented  in 
Chapter  7.) 

While  the  team  members  were  confident  that  they  had  conducted  the  analysis  properly  -  with- 
in the  limitations  of  the  information  they  had  -  they  stressed  that  many  uncertainties  remained. 
First,  there  was  great  uncertainty  about  where  the  debris  had  struck.  Second,  Crater,  the  analyt- 
ical tool  they  used  to  predict  the  penetration  depth  of  debris  impact,  was  being  used  on  a  piece 
of  debris  that  was  400  times  larger  than  the  standard  in  Boeing's  database.  (At  the  time,  the 
team  believed  that  the  debris  was  640  times  larger.)  Engineers  ultimately  concluded  that  their 
analysis,  limited  as  it  was,  did  not  show  that  a  safety-of-flight  issue  existed.  Engineers  who 
attended  this  briefing  indicated  a  belief  that  management  focused  on  the  answer-  that  analysis 
proved  there  was  no  safety-of-flight  issue  -  rather  than  concerns  about  the  large  uncertainties 
that  may  have  undermined  the  analysis  that  provided  that  answer. 
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At  the  Mission  Management  Team's  8:00  a.m.  meeting.  Mission  Evaluation  Room  manager 
Don  McCormack  verbally  summarized  the  Debris  Assessment  Team's  7:00  a.m.  brief.  It  was 
the  third  topic  discussed.  Unlike  the  earlier  briefing,  McCormack's  presentation  did  not  include 
the  Debris  Assessment  Team's  presentation  charts.  The  Board  notes  that  no  supporting  analysis 
or  e.xamination  of  minority  engineering  views  was  asked  for  or  offered,  that  neither  Mission 
Evaluation  Room  nor  Mission  Management  Team  members  requested  a  technical  paper  of  the 
Debris  Assessment  Team  analysis,  and  that  no  technical  questions  were  asked. 

January  24,  2003,  Mission  Management  Team  Meeting  Transcript 

The  following  is  a  transcript  of  McCormack's  verbal  briefing  to  the  Mission  Management 
Team,  which  Linda  Ham  Chaired.  Early  in  the  meeting,  Phil  Engelauf.  Chief  of  the  Flight 
Director's  office,  reported  that  he  had  made  clear  in  an  e-mail  to  Colunihia's  crew  that  there 
were  "no  concerns"  that  the  debris  strike  had  caused  serious  damage.  The  Board  notes  that  this 
conclusion  about  whether  the  debris  strike  posed  a  safety-of-flight  issue  was  presented  to  Mis- 
sion Management  Team  members  before  they  discussed  the  debris  strike  damage  assessment. 

Engelauf:  '7  will  say  that  crew  did  send  down  a  note  last  nii^ht  asking  if  anybody  is  talking 
about  extension  days  or  going  to  go  with  that  and  we  sent  up  to  the  crew  about  a  15  second 
video  clip  of  the  strike  just  so  they  are  armed  if  they  get  any  questions  at  the  press  conferences 
or  that  sort  of  thing,  but  we  made  it  ver\-  clear  to  them  no,  no  concerns. " 

Linda  Ham:  ''When  is  the  press  conference'.'  Is  it  today/" 

Engelauf:  "It's  later  today." 

Ham:  "They  may  get  asked  because  the  press  is  aware  of  it. " 

Engelauf:  "The  press  is  aware  of  it  I  know  folks  have  asked  me  because  the  press  corps  at  the 
cape  have  been  asking. .  .wanted  to  make  sure  they  were  properly. . . " 

Ham:  "Okay,  back  on  the  temperature..." 

The  meeting  went  on  for  another  25  minutes.  Other  mission-related  subjects  were  discussed 
before  team  members  returned  to  the  debris  strike. 

Ham:  "Go  ahead,  Don. " 

Don  McCormack:  "Okay.  And  also  we've  received  the  data  from  the  systems  integration  guys 
of  the  potential  ranges  of  sizes  and  impact  angles  and  where  it  might  have  hit.  And  the  guys 
have  gone  off  and  done  an  analysis,  they  use  a  tool  they  refer  to  as  Crater  which  is  their  official 
evaluation  tool  to  determine  the  potential  size  of  the  damage.  So  they  went  off  and  done  all  that 
work  and  they've  done  thermal  analysis  to  the  areas  where  there  may  he  damaged  tiles.  The 
analysis  is  not  complete.  There  is  one  case  yet  that  they  wish  to  run,  hut  kind  of  just  Jumping  to 
the  conclusion  of  all  that,  they  do  show  that,  obviously,  a  potential  for  significant  tile  damage 
here,  but  thermal  analysis  does  not  indicate  that  there  is  potential  for  a  burn-through.  I  mean 
there  could  be  localized  heating  damage.  There  is...  obviously  there  is  a  lot  of  uncertainty  in 
all  this  in  terms  of  the  size  of  the  debris  and  where  it  hit  and  the  angle  of  incidence. " 

Ham:  "No  burn  through,  means  no  catastrophic  damage  and  the  localiz.ed  heating  damage 
would  mean  a  tile  replacement'.' " 

McCormack:  "Right,  it  would  mean  possible  impacts  to  turnaround  repairs  and  that  .sort  of 
thing,  but  we  do  not  see  any  kind  of  safety  of  flight  issue  here  yet  in  anything  that  we  've  looked 
at." 

Ham:  "And  no  safety  (f flight,  no  issue  for  this  missicm,  nothing  that  we're  going  to  do  different, 
there  may  be  a  turnaround. " 

McCormack:  "Right,  it  could  potentially  hit  the  RCC  and  we  don  'f  indicate  any  other  possible 
coating  damage  or  .something,  we  don 't  see  any  issue  if  it  hit  the  RCC.  Although  we  could  have 
some  significant  tile  damage  if  we  don 't  .see  a  .safety -of flight  issue. " 
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McCormack:  ''Well  it  could  he  down  throui>h  the  ...we  could  lose  an  entire  file  and  then  the 
ramp  into  and  out  of  that.  I  mean  it  could  he  a  significant  area  of  tile  damage  down  to  the  SIP 

perhaps,  so  it  could  he  a  significant  piece  missing,  hut. . . "  [SIP  refers  to  the  denser  lower  loyers  of 
tile  to  which  the  debris  may  have  penetrated.] 

Ham.:  "It  would  he  a  turnaround  issue  only?" 

McCormack:  "Right." 

(Unintelligible  speaker) 

At  this  point,  tile  expert  Calvin  Schomburg  states  his  belief  that  no  safety-of-flight  issue  exists. 
However,  some  participants  listening  via  teleconference  to  the  meeting  are  unable  to  hear  his 
comments. 

Ham:  "Okay.  Same  thing  you  told  me  about  the  other  day  in  my  office.  We  've  seen  pieces  of  this 
size  before  haven't  we'.''" 

Unknown  speaker.  "Hey  Linda,  we're  missing  part  of  that  conversation. " 

Ham:  "Right. " 

Unknown  speaker:  "Linda,  we  can 't  hear  the  .speaker. " 

Ham:  "He  was  just  reiterating  with  Calvin  that  he  doesn  't  believe  that  there  is  any  burn-through 
so  no  safi'ty  of  flight  kind  of  issue,  it 's  more  of  a  turiuiround  issue  similar  to  what  we  've  had  on 
other  flights.  That's  it?  Alright,  any  questions  on  that?" 

The  Board  notes  that  when  the  official  minutes  of  the  January  24  Mission  Management  Team 
were  produced  and  distributed,  there  was  no  mention  of  the  debris  strike.  These  minutes  were 
approved  and  signed  by  Frank  Moreno,  STS-107  Lead  Payload  Integration  Manager,  and  Linda 
Ham.  For  anyone  not  present  at  the  January  24  Mission  Management  Team  who  was  relying  on 
the  minutes  to  update  them  on  key  issues,  they  would  have  read  nothing  about  the  debris-strike 
discussions  between  Don  McCormack  and  Linda  Ham. 

A  subsequent  8:59  a.m.  Mission  Evaluation  Room  console  log  entiy  follows. 

"MMT Summary. .  .McCormack  also  summarized  the  debris  assessment.  Bottom  line  is  that 
there  appears  to  he  no  safely  of  flight  issue,  but  good  chance  of  turnaround  impact  to  repair 
tile  damage.  "  ltAM7=Mission  Management  Team] 

Flight  Day  10  through  16,  Saturday  through  Friday,  January  25  through  31,  2003 

Although  "no  safety-of-fiight  issue"  had  officially  been  noted  in  the  Mission  Evaluation  Room 
log,  the  Debris  Assessment  Team  was  still  working  on  parts  of  its  analysis  of  potential  damage 
to  the  wing  and  main  landing  gear  door.  On  Sunday,  January  26,  Rodney  Rocha  spoke  with  a 
Boeing  thermal  analyst  and  a  Boeing  stress  analyst  by  telephone  to  express  his  concern  about 
the  Debris  Assessment  Team's  overall  analysis,  as  well  as  the  remaining  work  on  the  main  land- 
ing gear  door  analysis.  After  the  Boeing  engineers  stated  their  confidence  with  their  analyses, 
Rocha  became  more  comfortable  with  the  damage  assessment  and  sent  the  following  e-mail  to 
his  management. 
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Original  Message 

From:  ROCHA,  ALAN  R.  (RODNEY)  (JSC-ES2)  (NASA) 

Sent:  Sunday,  January  26,  2003  7:45  PM 

To:  SHACK,  PAUL  E.  (JSC-EA42)  (NASA);  MCCORMACK,  DONALD  L.  (DON)  (JSC-MV6)  (NASA);  OUELLETTE,  FRED  A. 

(JSC-MV6)  (NASA) 
Cc:  ROGERS,  JOSEPH  E.  (JOE)  (JSC-ES2)  (NASA);  GALBREATH,  GREGORY  F.  (GREG)  (JSC-ES2)  (NASA);  JACOBS, 

JEREMY  B.  (JSC-ES4)  (NASA);  SERIALE-GRUSH,  JOYCE  M.  (JSC-EA)  (NASA);  KRAMER,  JULIE  A.  (JSC-EA4) 

(NASA);  CURRY,  DONALD  M.  (JSC-ES3)  (NASA);  KOWAL,  T.  J.  (JOHN)  (JSC-ES3)  (NASA);  RICKMAN,  STEVEN  L. 

(JSC-ES3)  (NASA);  SCHOMBURG,  CALVIN  (JSC-EA)  (NASA);  CAMPBELL,  CARLISLE  C,  JR  (JSC-ES2)  (NASA) 
Subject:  STS-107  Wing  Debris  Impact  on  Ascent:  Final  analysis  case  completed 

As  you  recall  from  Friday's  briefing  to  the  MER,  there  remained  open  work  to  assess  analytically 
predicted  impact  damage  to  the  wing  underside  in  the  region  of  the  main  landing  gear  door.  This  area 
was  considered  a  low  probability  hit  area  by  the  image  analysis  teams,  but  they  admitted  a  debris 
strike  here  could  not  be  ruled  out. 

As  with  the  other  analyses  performed  and  reported  on  Friday,  this  assessment  by  the  Boeing  multi- 
technical  discipline  engineering  teams  also  employed  the  system  integration's  dispersed  trajectories 
followed  by  serial  results  from  the  Crater  damage  prediction  tool,  thermal  analysis,  and  stress  analy- 
sis. It  was  reviewed  and  accepted  by  the  ES-DCE  (R.  Rocha)  by  Sunday  morning,  Jan.  26.  The  case 
is  defined  by  a  large  area  gouge  about  7  inch  wide  and  about  30  inch  long  with  sloped  sides  like  a 
crater,  and  reaching  down  to  the  densified  layer  of  the  TPS. 

SUMMARY:  Though  this  case  predicted  some  higher  temperatures  at  the  outer  layer  of  the  hon- 
eycomb aluminum  face  sheet  and  subsequent  debonding  of  the  sheet,  there  is  no  predicted  burn- 
through  of  the  door,  no  breeching  of  the  thermal  and  gas  seals,  nor  is  there  door  structural  deforma- 
tion or  thermal  warpage  to  open  the  seal  to  hot  plasma  intrusion.  Though  degradation  of  the  TPS  and 
door  structure  is  likely  (if  the  impact  occurred  here),  there  is  no  safety  of  flight  (entry,  descent,  land- 
ing) issue. 

Note  to  Don  M.  and  Fred  O.:  On  Friday  I  believe  the  MER  was  thoroughly  briefed  and  it  was  clear  that 
open  work  remained  (viz.,  the  case  summarized  above),  the  message  of  open  work  was  not  clearly 
given,  in  my  opinion,  to  Linda  Ham  at  the  MMT.  I  believe  we  left  her  the  impression  that  engineering 
assessments  and  cases  were  all  finished  and  we  could  state  with  finality  no  safety  of  flight  issues  or 
questions  remaining.  This  very  serious  case  could  not  be  ruled  out  and  it  was  a  very  good  thing  we 
carried  it  through  to  a  finish. 

Rodney  Rocha  (ES2) 

•  Division  Shuttle  Chief  Engineer  (DCE),  ES-Structural  Engineering  Division 

•  Chair,  Space  Shuttle  Loads  &  Dynamics  Panel 


[MER-Mission   Evaluafion   Room,    ES-DCE=Siructural  Engineering-Division   Shuffle   Chiei  Engineer,    TPS=Thermal  Protection 
System] 


In  response  to  this  e-mail,  Don  McCormack  told  Rocha  that  he  would  make  sure  to  correct 
Linda  Ham's  possible  misconception  that  the  Debris  Assessment  Team's  analysis  was  finished 
as  of  the  briefing  to  the  Mission  Management  Team.  McCormack  informed  Ham  at  the  next 
Mission  Management  Team  meeting  on  January  27,  that  the  damage  assessment  had  in  fact 
been  ongoing  and  that  their  final  conclusion  was  that  no  safety-of-flight  issue  existed.  The  de- 
bris strike,  in  the  official  estimation  of  the  Debris  Assessment  Team,  amounted  to  only  a  post- 
landing  turn-around  maintenance  issue. 

On  Monday  morning.  January  27,  Doug  Drewry.  a  structural  engineering  manager  from  John- 
son Space  Center,  summoned  several  Johnson  engineers  and  Rocha  to  his  office  and  asked  them 
if  they  all  agreed  with  the  completed  analyses  and  with  the  conclusion  that  no  safety-of-flight 
issues  existed.  Although  all  participants  agreed  with  that  conclusion,  they  also  knew  that  the 
Debris  Assessment  Team  members  and  most  structural  engineers  at  Johnson  still  wanted  im- 
ages of  C(>hiinhui\  left  wing  but  had  given  up  trying  to  make  that  desire  fit  the  "mandatory" 
requirement  that  Shuttle  management  had  set. 
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Langley  Research  Center 

Although  the  Debris  Analysis  Team  had  completed  its  analysis  and  rendered  a  "no  safety-of- 
flight"  verdict,  concern  persisted  among  engineers  elsewhere  at  NASA  as  they  learned  about 
the  debris  strike  and  potential  damage.  On  Monday.  January  27,  Carlisle  Campbell,  the  design 
engineer  responsible  for  landing  gear/tires/brakes  at  Johnson  Space  Center  forwarded  Rodney 
Rocha's  January  26,  e-mail  to  Bob  Daugherty,  an  engineer  at  Langley  Research  Center  who 
specialized  in  landing  gear  design.  Engineers  at  Langley  and  Ames  Research  Center  and  John- 
son Space  Center  did  not  entertain  the  possibility  of  Coltiiiihia  breaking  up  during  re-entry, 
but  rather  focused  on  the  idea  that  landing  might  not  be  safe,  and  that  the  crew  might  need  to 
"ditch"  the  vehicle  (crash  land  in  water)  or  be  prepared  to  land  with  damaged  landing  gear. 

Campbell  initially  contacted  Daugherty  to  ask  his  opinion  of  the  arguments  used  to  declare  the 
debris  strike  "not  a  safety-of-flight  issue."  Campbell  commented  that  someone  had  brought  up 
worst-case  scenarios  in  which  a  breach  in  the  main  landing  gear  door  causes  two  tires  to  go  flat. 
To  help  Daugherty  understand  the  problem,  Campbell  forwarded  him  e-mails,  briefing  slides, 
and  film  clips  from  the  debris  damage  analysis. 

Both  engineers  felt  that  the  potential  ramifications  of  landing  with  two  flat  tires  had  not  been 
sufficiently  explored.  They  discussed  using  Shuttle  simulator  facilities  at  Ames  Research  Cen- 
ter to  simulate  a  landing  with  two  flat  tires,  but  initially  ruled  it  out  because  there  was  no  formal 
request  from  the  Mission  Management  Team  to  work  the  problem.  Because  astronauts  were 
training  in  the  Ames  simulation  facility,  the  two  engineers  looked  into  conducting  the  simula- 
tions after  hours.  Daugherty  contacted  his  management  on  Tuesday,  January  28,  to  update  them 
on  the  plan  for  after-hours  simulations.  He  reviewed  previous  data  runs,  current  simulation 
results,  and  prepared  scenarios  that  could  result  from  main  landing  gear  problems. 

The  simulated  landings  with  two  flat  tires  that  Daugherty  eventually  conducted  indicated  that  it 
was  a  survivable  but  very  serious  malfunction.  Of  the  various  scenarios  he  prepared,  Daugherty 
shared  the  most  unfavorable  only  with  his  management  and  selected  Johnson  Space  Center 
engineers.  In  contrast,  his  favorable  simulation  results  were  forwarded  to  a  wider  Johnson  audi- 
ence for  review,  including  Rodney  Rocha  and  other  Debris  Assessment  Team  members.  The 
Board  is  disappointed  that  Daugherty *s  favorable  scenarios  received  a  wider  distribution  than 
his  discovery  of  a  potentially  serious  malfunction,  and  also  does  not  approve  of  the  reticence 
that  he  and  his  managers  displayed  in  not  notifying  the  Mission  Management  Team  of  their 
concerns  or  his  assumption  that  they  could  not  displace  astronauts  who  were  training  in  the 
Am^s  simulator. 

At  4:36  p.m.  on  Monday,  January  27,  Daugherty  sent  the  following  to  Campbell. 


Original  Message 

From:  Robert  H.  Daugherty 

Sent:  Monday,  January  27,  2003  3:35  PM 

To:  CAMPBELL,  CARLISLE  C,  JR  (JSC-ES2)  (NASA) 

Subject:         Video  you  sent 

WOW!!! 

I  bet  there  are  a  few  pucker  strings  pulled  tight  around  there! 

Thinking  about  a  belly  landing  versus  bailout (I  would  say  that  if  there  is  a  question  about  main 

gear  well  burn  thru  that  its  crazy  to  even  hit  the  deploy  gear  button. ..the  reason  being  that  you  might 
have  failed  the  wheels  since  they  are  aluminum.. they  will  fail  before  the  tire  heating/pressure  makes 
them  fail. .and  you  will  send  debris  all  over  the  wheel  well  making  it  a  possibility  that  the  gear  would 
not  even  deploy  due  to  ancillary  damage. ..300  feet  is  the  wrong  altitude  to  find  out  you  have  one  gear 
down  and  the  other  not  down. ..you're  dead  in  that  case) 

Think  about  the  pitch-down  moment  for  a  belly  landing  when  hitting  not  the  main  gear  but  the  trailing 
edge  of  the  wing  or  body  flap  when  landing  gear  up. ..even  if  you  come  in  fast  and  at  slightly  less  pitch 
attitude. ..the  nose  slapdown  with  that  pitching  moment  arm  seems  to  me  to  be  pretty  scary.. .so  much 
so  that  I  would  bail  out  before  I  would  let  a  loved  one  land  like  that. 
My  two  cents. 
See  ya, 
Bob 

— — ^^^— — — — — ^— ^—  Report    volume     I  August     2003  ^^^__^^_^_______ 


COLUMBIA 

ACCIDENT  INVESTIGATION  BOARD 


The  following  reply  from  Campbell  to  Daugherty  was  sent  at  4:49  p.m. 


Original  Message 

From:  "CAMPBELL,  CARLISLE  C,  JR  (JSC-ES2)  (NASA)" 

To:  "'Bob  Daugherty'" 

Subject:  FW:  Video  you  sent 

Date:  Mon,  27  Jan  2003  15:59:53  -0600 

X-Mailer:         RInternet  Mail  Service  (5.5.2653.19) 

Thanks.  That's  why  they  need  to  get  all  the  facts  in  early  on--such  as  look  at  innpact  damage  from  the 
spy  telescope.  Even  then,  we  may  not  know  the  real  effect  of  the  damage. 

The  LaRC  ditching  model  tests  20  some  years  ago  showed  that  the  Orbiter  was  the  best  ditching 
shape  that  they  had  ever  tested,  of  many.  But,  our  structures  people  have  said  that  if  we  ditch  we 
would  blow  such  big  holes  in  the  lower  panels  that  the  orbiter  might  break  up.  Anyway,  they  refuse  to 
even  consider  water  ditching  any  more--!  still  have  the  test  results[  Bailout  seems  best. 


[LaRC=Langley  Research  Center] 


On  the  next  day,  Tuesday,  Daugherty  sent  the  following  to  Campbell. 


Original  Message 

From:  Robert  H.  Daugherty 

Sent:  Tuesday,  January  28,  2003  12:39  PM 

To:  CAMPBELL,  CARLISLE  C,  JR  (JSC-ES2)  (NASA) 

Subject:  Tile  Damage 

Any  more  activity  today  on  the  tile  damage  or  are  people  just  relegated  to 
crossing  their  fingers  and  hoping  for  the  best? 
See  ya, 
Bob 


Campbell's  reply: 


Original  Message 

From:  "CAMPBELL,  CARLISLE  C,  JR  (JSC-ES2)  (NASA)" 

To:  "'Robert  H.  Daugherty'" 

Subject:  RE:  Tile  Damage 

Date:  Tue,  28  Jan  2003  13:29:58  -0600 

X-Mailer:         Internet  Mail  Service  (5.5.2653.19) 

I  have  not  heard  anything  new.  I'll  let  you  know  if  I  do. 

COG 


Carlisle  Campbell  sent  the  following  e-mail  to  Johnson  Space  Center  engineering  managers  on 
January  31. 

"In  order  to  alleviate  concerns  regardin;^  the  worst  case  scenario  which  could  potentially 
he  caused  by  the  debris  impact  under  the  Orbiter  '.v  left  wing  during  launch,  EG  conducted 
some  landing  simulations  on  the  Ames  Vertical  Motion  Simulator  which  tested  the  ability 
of  the  crew  and  vehicle  to  sur\'ive  a  condition  where  two  main  gear  tires  are  deflated  before 
landing.  The  results,  although  limited,  showed  that  this  condition  is  controllable,  including 
the  nose  slap  down  rates.  These  results  may  give  MOD  a  different  decision  path  should 
this  scenario  become  a  reality.  Previous  opinions  were  that  bailout  was  the  only  answer." 
fEG=Aeroscience  and  F/ig/it  Mechanics  Divh'ion,  tAOD=Mhsion  Operations  Directorate] 
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In  the  Mission  Evaluation  Room,  a  safety  representative  from  Science  Applications  Interna- 
tional Corporation.  NASA's  contract  safety  company,  made  a  log  entry  at  the  Safety  and  Quality 
Assurance  console  on  January  28,  at  12:15  p.m.  It  was  only  the  second  mention  of  the  debris 
strike  in  the  safety  console  log  during  the  mission  (the  first  was  also  minor). 

"[MCC  SAJCJ  called  asking  if  any  SR&QA  people  were  involved  in  the  deeision  to  say  that 
the  aseent  debris  hit  (left  wing)  is  safe.  [SAIC  engineer]  has  indeed  been  involved  in  the 
analysis  and  stated  that  he  eoimtrs  with  the  analysis.  Details  about  the  debris  hit  are  found 
in  the  Flight  Da\  12  MER  Manager  and  our  Daily  Report. "  fMCC=Mission  Control  Center, 
SA/C=Science  Applications  International  Corporation,  SR&QA=Safety,  Reliabilify,  and  Quality  As- 
surance, MER=Mission  Evaluation  Room] 

Missed  Opportunity  8 

According  to  a  Memorandum  for  the  Record  written  by  William  Readdy,  Associate  Administra- 
tor for  Sp'iice  Flight.  Readdy  and  Michael  Card,  from  NASA's  Safety  and  Mission  Assurance 
Office,  discussed  an  offer  of  Department  of  Defense  imagery  support  for  Columbia.  This  Janu- 
ary 29.  conversation  ended  with  Readdy  telling  Card  that  NASA  would  accept  the  offer  but 
because  the  Mission  Management  Team  had  concluded  that  this  was  not  a  safety -of-flight  issue, 
the  imagery  should  be  gathered  only  on  a  low  priority  "not-to-interfere"  basis.  Ultimately,  no 
imagery  was  taken. 

The  Board  notes  that  at  the  January  31 ,  Mission  Management  Team  meeting,  there  was  only  a 
minor  mention  of  the  debris  strike.  Other  issues  discussed  included  onboard  crew  consumables, 
the  status  of  the  leaking  water  separator,  an  intercom  anomaly,  SPACEHAB  water  flow  rates, 
an  update  of  the  status  of  onboard  experiments,  end-of-mission  weight  concerns,  landing  day 
weather  forecasts,  and  landing  opportunities.  The  only  mention  of  the  debris  strike  was  a  brief 
comment  by  Bob  Page,  representing  Kennedy  Space  Center's  Launch  Integration  Office,  who 
stated  that  the  crew's  hand-held  cameras  and  External  Tank  films  would  be  expedited  to  Mar- 
shall Space  Flight  Center  via  the  Shuttle  Training  Aircraft  for  post-flight  foam/debris  imagery 
analysis,  per  Linda  Ham's  request. 

Summary:  Mission  Management  Decision  Making 

Discovery  and  Initial  Analysis  of  Debris  Strike 

In  the  course  of  examining  film  and  video  images  oi  Columbia's  ascent,  the  Intercenter  Photo 
Working  Group  identified,  on  the  day  after  launch,  a  large  debris  strike  to  the  leading  edge 
of  Columbia?,  left  wing.  Alarmed  at  seeing  so  severe  a  hit  so  late  in  ascent,  and  at  not  hav- 
ing a  clear  view  of  damage  the  strike  might  have  caused,  Intercenter  Photo  Working  Group 
members  alerted  senior  Program  managers  by  phone  and  sent  a  digitized  clip  of  the  strike 
to  hundreds  of  NASA  personnel  via  e-mail.  These  actions  initiated  a  contingency  plan  that 
brought  together  an  interdisciplinary  group  of  experts  from  NASA,  Boeing,  and  the  United 
Space  Alliance  to  analyze  the  strike.  So  concerned  were  Intercenter  Photo  Working  Group 
personnel  that  on  the  day  they  discovered  the  debris  strike,  they  tapped  their  Chair,  Bob  Page, 
to  see  through  a  request  to  image  the  left  wing  with  Department  of  Defense  assets  in  anticipa- 
tion of  analysts  needing  these  images  to  better  determine  potential  damage.  By  the  Board's 
count,  this  would  be  the  first  of  three  requests  to  secure  imagery  of  Columbia  on-orbit  during 
the  16-day  mission. 


Imagery  Requests 

i.     Flight  Day  2.  Bob  Page,  Chair,  Intercenter  Photo  Working  Group  to  Wayne  Hale.  .Shuttle  Pro- 
gram Manager  for  Launch  Integration  at  Kennedy  Space  Center  (in  person). 

2.  Flight  Day  6.  Bob  White,  United  Space  Alliance  manager,  to  Lambert  Austin,  head  of  the  Space 
Shuttle  Systems  Integration  at  Johnson  Space  Center  (by  phone). 

3.  Flight  Day  6.  Rodney  Rocha,  Co-Chair  of  Debris  Assessment  Team  to  Paul  Shack,  Manager, 
Shuttle  Engineering  Office  (by  e-mail). 
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Missed  Opportunities  ■§ 

1.  Flight  Day  4.  Rodney  Rocha  inquires  if  crew  has  been  asked  to  inspect  for  damage.  No  re- 
sponse. 

2.  Flight  Day  6.  Mission  Control  fails  to  ask  crew  member  David  Brow  n  to  downlink  video  he  took 
of  External  Tank  separation,  which  may  have  revealed  missing  bipod  foam. 

3.  Flight  Day  6.  NASA  and  National  Imagery  and  Mapping  Agency  personnel  discuss  possible 
request  for  imagery.  No  action  taken. 

4.  Flight  Day  7.  Wayne  Hale  phones  Department  of  Defense  representative,  who  begins  identify- 
ing imaging  assets,  only  to  be  stopped  per  Linda  Ham's  orders. 

5.  Flight  Day  7.  Mike  Card,  a  NASA  Headquarters  manager  from  the  Safety  and  Mission  Assur- 
ance Office,  discusses  imagery  request  with  Mark  Emtinger.  Johnson  Space  Center  Safety  and 
Mission  Assurance.  No  action  taken. 

6.  Flight  Day  7.  Mike  Card  discusses  imagery  request  with  Br>'an  O'Connor.  Associate  Adminis- 
trator for  Safety  and  Mission  Assurance.  No  action  taken. 

7.  Flight  Day  8.  Barbara  Conte.  after  discussing  imagery  request  with  Rodney  Rocha.  calls  LeRoy 
Cain,  the  STS-107  ascent/entry  Flight  Director  Cain  checks  with  Phil  Engelauf.  and  then  deliv- 
ers a  "no"  answer. 

8.  Flight  Day  14.  Michael  Card,  from  NASA's  Safety  and  Mission  Assurance  Office,  discusses  the 
imaging  request  with  William  Readdy.  Associate  Administrator  for  Space  Flight.  Readdy  directs 
that  imagery  should  only  be  gathered  on  a  "not-to-interfere"  basis.  None  wtts  forthcoming. 

Upon  learning  of  the  debris  strike  on  Flight  Day  Two.  the  responsible  system  area  manager 
from  United  Space  Alliance  and  her  NASA  counterpart  formed  a  team  to  analyze  the  debris 
strike  in  accordance  with  mission  rules  requiring  the  careful  examination  of  any  '"out-of-fam- 
ily"  event.  Using  film  from  the  Intercenter  Photo  Working  Group,  Boeing  systems  integration 
analysts  prepared  a  preliminary  analysis  that  afternoon.  (Initial  estimates  of  debris  size  and 
speed,  origin  of  debris,  and  point  of  impact  would  later  prove  remarkably  accurate.) 

As  Flight  Day  Three  and  Four  unfolded  over  the  Martin  Luther  King  Jr.  holiday  weekend,  en- 
gineers began  their  analysis.  One  Boeing  analyst  used  Crater,  a  mathematical  prediction  tool, 
to  assess  possible  damage  to  the  Thermal  Protection  System.  Analysis  predicted  tile  damage 
deeper  than  the  actual  tile  depth,  and  penetration  of  the  RCC  coating  at  impact  angles  above 
15  degrees.  This  suggested  the  potential  for  a  burn-through  during  re-entry.  Debris  Assessment 
Team  members  judged  that  the  actual  damage  would  not  be  as  severe  as  predicted  because  of 
the  inherent  conservatism  in  the  Crater  model  and  because,  in  the  case  of  tile.  Crater  does  not 
take  into  account  the  tile's  stronger  and  more  impact-resistant  "densified"  layer,  and  in  the 
case  of  RCC,  the  lower  density  of  foam  would  preclude  penetration  at  impact  angles  under  21 
degrees. 

On  Flight  Day  Five,  impact  assessment  results  for  tile  and  RCC  were  presented  at  an  informal 
meeting  of  the  Debris  Assessment  Team,  which  was  operating  without  direct  Shuttle  Program 
or  Mission  Management  leadership.  Mission  Control's  engineering  support,  the  Mission  Evalu- 
ation Room,  provided  no  direction  for  team  activities  other  than  to  request  the  team's  results 
by  January  24.  As  the  problem  was  being  worked.  Shuttle  managers  did  not  formally  direct 
the  actions  of  or  consult  with  Debris  Assessment  Team  leaders  about  the  team's  assumptions, 
uncertainties,  progress,  or  interim  results,  an  unusual  circumstance  given  that  NASA  managers 
are  normally  engaged  in  analyzing  what  they  view  as  problems.  At  this  meeting,  participants 
agreed  that  an  image  of  the  area  of  the  wing  in  question  was  essential  to  refine  their  analysis  and 
reduce  the  uncertainties  in  their  damage  assessment. 

Each  member  supported  the  idea  to  seek  imagery  from  an  outside  source.  Due  in  part  to  a  lack 
of  guidance  from  the  Mission  Management  Team  or  Mission  Evaluation  Room  managers,  the 
Debris  Assessment  Team  chose  an  unconventional  route  for  its  request.  Rather  than  working 
the  request  up  the  normal  chain  of  command  -  through  the  Mission  Evaluation  Room  to  the 
Mission  Management  Team  for  action  to  Mission  Control  -  team  members  nominated  Rodney 
Rocha.  the  team's  Co-Chair,  to  pursue  the  request  through  the  Engineering  Directorate  at  John- 
son Space  Center.  As  a  result,  even  after  the  accident  the  Debris  Assessment  Team's  request  was 
viewed  by  Shuttle  Program  managers  as  a  non-critical  engineering  desire  rather  than  a  critical 
operational  need. 
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When  the  team  learned  that  the  Mission  Management  Team  was  not  pursuing  on-orbit  imag- 
ing, members  were  concerned.  What  Debris  Assessment  Team  members  did  not  realize  was 
the  negative  response  from  the  Program  was  not  necessarily  a  direct  and  final  response  to  their 
official  request.  Rather,  the  "no"  was  in  part  a  response  to  requests  for  imagery  initiated  by  the 
Intercenter  Photo  Working  Group  at  Kennedy  on  Flight  Day  2  in  anticipation  of  analysts'  needs 
that  had  become  by  Flight  Day  6  an  actual  engineering  request  by  the  Debris  Assessment  Team, 
made  informally  through  Bob  White  to  Lambert  Austin,  and  formally  through  Rodney  Rocha's 
e-mail  to  Paul  Shack.  Even  after  learning  that  the  Shuttle  Program  was  not  going  to  provide  the 
team  with  imagery,  some  members  sought  information  on  how  to  obtain  it  anyway. 

Debris  Assessment  Team  members  believed  that  imaging  of  potentially  damaged  areas  was 
necessary  even  after  the  January  24,  Mission  Management  Team  meeting,  where  they  had  re- 
ported their  results.  Why  they  did  not  directly  approach  Shuttle  Program  managers  and  share 
their  concern  and  uncertainty,  and  why  Shuttle  Program  managers  claimed  to  be  isolated  from 
engineers,  are  points  that  the  Board  labored  to  understand.  Several  reasons  for  this  communica- 
tions failure  relate  to  NASA's  interna!  culture  and  the  climate  established  by  Shuttle  Program 
management,  which  are  discussed  in  more  detail  in  Chapters  7  and  8. 

A  Flawed  Analysis 

An  inexperienced  team,  using  a  mathematical  tool  that  was  not  designed  to  assess  an  impact 
of  this  estimated  size,  performed  the  analysis  of  the  potential  effect  of  the  debris  impact.  Cra- 
ter was  designed  for  "in-family"  impact  events  and  was  intended  for  day-of-launch  analysis 
of  debris)  impacts.  It  was  not  intended  for  large  projectiles  like  those  observed  on  STS-107. 
Crater  initially  predicted  possible  damage,  but  the  Debris  Assessment  Team  assumed,  without 
theoretical  or  experimental  validation,  that  because  Crater  is  a  conservative  tool  -  that  is,  it  pre- 
dicts more  damage  than  will  actually  occur  -  the  debris  would  stop  at  the  tile's  densified  layer, 
even  though  their  experience  did  not  involve  debris  strikes  as  large  as  STS-107's.  Crater-like 
equations  were  also  used  as  part  of  the  analysis  to  assess  potential  impact  damage  to  the  wing 
leading  edge  RCC.  Again,  the  tool  was  used  for  something  other  than  that  for  which  it  was 
designed;  again,  it  predicted  possible  penetration;  and  again,  the  Debris  Assessment  Team  used 
engineering  arguments  and  their  experience  to  discount  the  results. 

As  a  result  of  a  transition  of  responsibility  for  Crater  analysis  from  the  Boeing  Huntington 
Beach  facility  to  the  Houston-based  Boeing  office,  the  team  that  conducted  the  Crater  analyses 
had  been  formed  fairly  recently,  and  therefore  could  be  considered  less  experienced  when  com- 
pared with  the  more  senior  Huntington  Beach  analysts.  In  fact,  STS-107  was  the  first  mission  for 
whicli  they  were  solely  responsible  for  providing  analysis  with  the  Crater  tool.  Though  post-ac- 
cident interviews  suggested  that  the  training  for  the  Houston  Boeing  analysts  was  of  high  quality 
and  adequate  in  substance  and  duration,  communications  and  theoretical  understandings  of  the 
Crater  model  among  the  Houston-based  team  members  had  not  yet  developed  to  the  standard  of 
a  more  senior  team.  Due  in  part  to  contractual  arrangements  related  to  the  transition,  the  Hous- 
ton-based team  did  not  take  full  advantage  of  the  Huntington  Beach  engineers'  experience. 

At  the  January  24,  Mission  Management  Team  meeting  at  which  the  "no  safety -of-flight"  con- 
clusion was  presented,  there  was  little  engineering  discussion  about  the  assumptions  made,  and 
how  the  results  would  differ  if  other  assumptions  were  used. 

Engineering  solutions  presented  to  management  should  have  included  a  quantifiable  range  of 
uncertainty  and  risk  analysis.  Those  types  of  tools  were  readily  available,  routinely  used,  and 
would  have  helped  management  understand  the  risk  involved  in  the  decision.  Management,  in 
turn,  should  have  demanded  such  information.  The  very  absence  of  a  clear  and  open  discussion 
of  uncertainties  and  assumptions  in  the  analysis  presented  should  have  caused  management  to 
probe  further. 

Shuttle  Program  Management's  Low  Level  of  Concern 

While  the  debris  strike  was  well  outside  the  activities  covered  by  normal  mission  flight  rules. 
Mission  Management  Team  members  and  Shuttle  Program  managers  did  not  treat  the  debris 
strike  as  an  issue  that  required  operational  action  by  Mission  Control.  Program  managers,  from 
Ron  Dittemore  to  individual  Mission  Management  Team  members,  had,  over  the  course  of  the 
Space  Shuttle  Program,  gradually  become  inured  to  External  Tank  foam  losses  and  on  a  funda- 
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mental  level  did  not  believe  foam  striking  the  vehicle  posed  a  critical  threat  to  the  Orbiter.  In 
particular.  Shuttle  managers  exhibited  a  belief  that  RCC  panels  are  impervious  to  foam  impacts. 
Even  after  seeing  the  video  of  Coliinihia's  debris  impact,  learning  estimates  of  the  size  and 
location  of  the  strike,  and  noting  that  a  foam  strike  with  sufficient  kinetic  energy  could  cause 
Thermal  Protection  System  damage,  management's  level  of  concern  did  not  change. 

The  opinions  of  Shuttle  Program  managers  and  debris  and  photo  analysts  on  the  potential 
severity  of  the  debris  strike  diverged  early  in  the  mission  and  continued  to  diverge  as  the  mis- 
sion progressed,  making  it  increasingly  difficult  for  the  Debris  Assessment  Team  to  have  their 
concerns  heard  by  those  in  a  decision-making  capacity.  In  the  face  of  Mission  managers"  low 
level  of  concern  and  desire  to  get  on  with  the  mission.  Debris  Assessment  Team  members  had 
to  prove  unequivocally  that  a  safety-of-flight  issue  existed  before  Shuttle  Program  management 
would  move  to  obtain  images  of  the  left  wing.  The  engineers  found  themselves  in  the  unusual 
position  of  having  to  prove  that  the  situation  was  unsafe  -  a  reversal  of  the  usual  requirement 
to  prove  that  a  situation  is  safe. 

Other  factors  contributed  to  Mission  management's  ability  to  resist  the  Debris  Assessment 
Team's  concerns.  A  tile  expert  told  managers  during  frequent  consultations  that  strike  damage 
was  only  a  maintenance-level  concern  and  that  on-orbit  imaging  of  potential  wing  damage  was 
not  necessary.  Mission  management  welcomed  this  opinion  and  sought  no  others.  This  constant 
reinforcement  of  managers'  pre-existing  beliefs  added  another  block  to  the  wall  between  deci- 
sion makers  and  concerned  engineers. 

Another  factor  that  enabled  Mission  management's  detachment  from  the  concerns  of  their  own 
engineers  is  rooted  in  the  culture  of  N.ASA  itself.  The  Board  observed  an  unofficial  hierarchy 
among  N.ASA  programs  and  directorates  that  hindered  the  flow  of  communications.  The  effects 
of  this  unofficial  hierarchy  are  seen  in  the  attitude  that  members  of  the  Debris  Assessment  Team 
held.  Part  of  the  reason  they  chose  the  institutional  route  for  their  imagery  request  was  that 
without  direction  from  the  Mission  Evaluation  Room  and  Mission  Management  Team,  they  felt 
more  comfortable  with  their  own  chain  of  command,  which  was  outside  the  Shuttle  Program. 
Further,  when  asked  by  investigators  why  they  were  not  more  vocal  about  their  concerns.  De- 
bris Assessment  Team  members  opined  that  by  raising  contrary  points  of  view  about  Shuttle 
mission  safety,  they  would  be  singled  out  for  possible  ridicule  by  their  peers  and  managers. 

A  Lack  of  Clear  Communication 

Communication  did  not  flow  effectively  up  to  or  down  from  Program  managers.  As  it  became 
clear  during  the  mission  that  managers  were  not  as  concerned  as  others  about  the  danger  of  the 
foam  strike,  the  ability  of  engineers  to  challenge  those  beliefs  greatly  diminished.  Managers'  ten- 
dency to  accept  opinions  that  agree  with  their  own  dams  the  flow  of  effective  communications. 

After  the  accident.  Program  managers  stated  privately  and  publicly  that  if  engineers  had  a  safe- 
ty concern,  they  were  obligated  to  communicate  their  concerns  to  management.  Managers  did 
not  seem  to  understand  that  as  leaders  they  had  a  corresponding  and  perhaps  greater  obligation 
to  create  viable  routes  for  the  engineering  community  to  express  their  views  and  receive  infor- 
mation. This  barrier  to  communications  not  only  blocked  the  flow  of  information  to  managers, 
but  it  also  prevented  the  downstream  flow  of  information  from  managers  to  engineers,  leaving 
Debris  Assessment  Team  members  no  basis  for  understanding  the  reasoning  behind  Mission 
Management  Team  decisions. 

The  January  27  to  January  3 1 ,  phone  and  e-mail  exchanges,  primarily  between  NASA  engi- 
neers at  Langley  and  Johnson,  illustrate  another  symptom  of  the  "cultural  fence"  that  impairs 
open  communications  between  mission  managers  and  working  engineers.  These  exchanges  and 
the  reaction  to  them  indicated  that  during  the  evaluation  of  a  mission  contingency,  the  Mission 
Management  Team  failed  to  disseminate  information  to  all  system  and  technology  experts  who 
could  be  consulted.  Issues  raised  by  two  Langley  and  Johnson  engineers  led  to  the  development 
of  "what-if  landing  scenarios  of  the  potential  outcome  if  the  main  landing  gear  door  sustained 
damaged.  This  led  to  behind-the-scenes  networking  by  these  engineers  to  use  NASA  facilities 
to  make  simulation  runs  of  a  compromised  landing  configuration.  These  engineers  -  who  un- 
derstood their  systems  and  related  technology  -  saw  the  potential  for  a  problem  on  landing  and 
ran  it  down  in  case  the  unthinkable  occurred.  But  their  concerns  never  reached  the  managers  on 
the  Mission  Management  Team  that  had  operational  control  over  Coliiiiihia. 
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A  Lack  of  Effective  Leadership 

The  Shuttle  Program,  the  Mission  Management  Team,  and  through  it  the  Mission  Evaluation 
Room,  were  not  actively  directing  the  efforts  of  the  Debris  Assessment  Team.  These  manage- 
ment teams  were  not  engaged  in  scenario  selection  or  discussions  of  assumptions  and  did  not 
actively  seek  status,  inputs,  or  even  preliminary  results  from  the  individuals  charged  with 
analyzing  the  debris  strike.  They  did  not  investigate  the  value  of  imagery,  did  not  intervene  to 
consult  the  more  experienced  Crater  analysts  at  Boeing's  Huntington  Beach  facility,  did  not 
probe  the  assumptions  of  the  Debris  Assessment  Team's  analysis,  and  did  not  consider  actions 
to  mitigate  the  effects  of  the  damage  on  re-entry.  Managers'  claims  that  they  didn't  hear  the 
engineers'  concerns  were  due  in  part  to  their  not  asking  or  listening. 

The  Failure  of  Safety's  Role 

As  will  be  discussed  in  Chapter  7,  safety  personnel  were  present  but  passive  and  did  not  serve 
as  a  channel  for  the  voicing  of  concerns  or  dissenting  views.  Safety  representatives  attended 
meetings  of  the  Debris  Assessment  Team,  Mission  Evaluation  Room,  and  Mission  Management 
Team,  but  were  merely  party  to  the  analysis  process  and  conclusions  instead  of  an  independent 
source  of  questions  and  challenges.  Safety  contractors  in  the  Mission  Evaluation  Room  were 
only  marginally  aware  of  the  debris  strike  analysis.  One  contractor  did  question  the  Debris  As- 
sessment Team  safety  representative  about  the  analysis  and  was  told  that  it  was  adequate.  No 
additional  inquiries  were  made.  The  highest-ranking  safety  representative  at  NASA  headquar- 
ters deferred  to  Program  managers  when  asked  for  an  opinion  on  imaging  of  Cohimhia.  The 
safety  manager  he  spoke  to  also  failed  to  follow  up. 

Summary 

Management  decisions  made  during  Columhias  final  flight  reflect  missed  opportunities, 
blocked  or  ineffective  communications  channels,  flawed  analysis,  and  ineffective  leadership. 
Perhaps  most  striking  is  the  fact  that  management  -  including  Shuttle  Program.  Mission  Man- 
agement Team,  Mission  Evaluation  Room,  and  Flight  Director  and  Mission  Control  -  displayed 
no  interest  in  understanding  a  problem  and  its  implications.  Because  managers  failed  to  avail 
themselves  of  the  wide  range  of  expertise  and  opinion  necessaiy  to  achieve  the  best  answer 
to  the  debris  strike  question  -  "W/,s  this  a  saf'ety-nf-fiii>ht  coiiceni'.'"  -  some  Space  Shuttle 
Program  managers  failed  to  fulfill  the  implicit  contract  to  do  whatever  is  possible  to  ensure  the 
safety  of  the  crew.  In  fact,  their  management  techniques  unknowingly  imposed  barriers  that 
keptat  bay  both  engineering  concerns  and  dissenting  views,  and  ultimately  helped  create  "blind 
spots"  that  prevented  them  from  seeing  the  danger  the  foam  strike  posed. 

Because  this  chapter  has  focused  on  key  personnel  who  participated  in  STS-107  bipod  foam 
debris  strike  decisions,  it  is  tempting  to  conclude  that  replacing  them  will  solve  all  NASA's 
problems.  However,  solving  NASA's  problems  is  not  quite  so  easily  achieved.  Peoples'  actions 
are  influenced  by  the  organizations  in  which  they  work,  shaping  their  choices  in  directions  that 
even  they  may  not  realize.  The  Board  explores  the  organizational  context  of  decision  making 
more  fully  in  Chapters  7  and  8. 

Findings 

Intercenter  Photo  Working  Group 

F6.3-I  The  foam  strike  was  first  seen  by  the  Intercenter  Photo  Working  Group  on  the  morn- 
ing of  Flight  Day  Two  during  the  standard  review  of  launch  video  and  high-speed 
photography.  The  strike  was  larger  than  any  seen  in  the  past,  and  the  group  was 
concerned  about  possible  damage  to  the  Orbiter.  No  conclusive  images  of  the  strike 
existed.  One  camera  that  may  have  provided  an  additional  view  was  out  of  focus 
because  of  an  improperly  maintained  lens. 

F6.3-2  The  Chair  of  the  Intercenter  Photo  Working  Group  asked  management  to  begin  the 
process  of  getting  outside  imagery  to  help  in  damage  assessment.  This  request,  the 
first  of  three,  began  its  journey  through  the  management  hierarchy  on  Flight  Day 
Two. 

F6.3-3  The  Intercenter  Photo  Working  Group  distributed  its  first  report,  including  a  digitized 
video  clip  and  initial  assessment  of  the  strike,  on  Flight  Day  Two.  This  information 
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was  widely  disseminated  to  NASA  and  contractor  engineers,  Siiuttle  Program  man- 
agers, and  Mission  Operations  Directorate  personnel. 
F6.3-4  Initial  estimates  of  debris  size,  speed,  and  origin  were  remarkably  accurate.  Initial  in- 
formation available  to  managers  stated  that  the  debris  originated  in  the  left  bipod  area 
of  the  External  Tank,  was  quite  large,  had  a  high  velocity,  and  stnick  the  underside  of 
the  left  wing  near  its  leading  edge.  The  report  stated  that  the  debris  could  have  hit  the 
RCC  or  tile! 

The  Debris  Assessment  Team 

F6.3-5  A  Debris  Assessment  Team  began  forming  on  Flight  Day  two  to  analyze  the  impact. 
Once  the  debris  strike  was  categorized  as  "out  of  family"  by  United  Space  Alliance, 
contractual  obligations  led  to  the  Team  being  Co-Chaired  by  the  cognizant  contrac- 
tor sub-system  manager  and  her  NASA  counteipart.  The  team  was  not  designated  a 
Tiger  Team  by  the  Mission  Evaluation  Room  or  Mission  Management  Team. 

F6.3-6  Though  the  Team  was  clearly  reporting  its  plans  (and  final  results)  through  the  Mis- 
sion Evaluation  Room  to  the  Mission  Management  Team,  no  Mission  manager  ap- 
peared to  "own"  the  Team's  actions.  The  Mission  Management  Team,  through  the 
Mission  Evaluation  Room,  provided  no  direction  for  team  activities,  and  Shuttle 
managers  did  not  formally  consult  the  Team's  leaders  about  their  progress  or  interim 
results. 

F6.3-7  During  an  organizational  meeting,  the  Team  discussed  the  uncertainty  of  the  data 
and  the  value  of  on-orbit  imagery  to  "bound"  their  analysis.  In  its  first  official  meet- 
ing the  next  day,  the  Team  gave  its  NASA  Co-Chair  the  action  to  request  imagery  of 
Colunihia  on-orbit. 

F6.3-8  The  Team  routed  its  request  for  imagery  through  Johnson  Space  Center's  Engineer- 
ing Directorate  rather  than  through  the  Mission  Evaluation  Room  to  the  Mission 
Management  Team  to  the  Flight  Dynamics  Officer,  the  channel  used  during  a  mis- 
sion. This  routing  diluted  the  urgency  of  their  request.  Managers  viewed  it  as  a  non- 
critical  engineering  desire  rather  than  a  critical  operational  need. 

F6.3-9  Team  members  never  realized  that  management's  decision  against  seeking  imagery 
was  not  intended  as  a  direct  or  final  response  to  their  request. 

F6.3-10  The  Team's  assessment  of  possible  tile  damage  was  performed  using  an  impact 
simulation  that  was  well  outside  Crater's  test  databa.se.  The  Boeing  analyst  was  inex- 
perienced in  the  use  of  Crater  and  the  interpretation  of  its  results.  Engineers  with  ex- 
tensive Themial  Protection  System  expertise  at  Huntington  Beach  were  not  actively 
involved  in  determining  if  the  Crater  results  were  properly  inteipreted. 

F6.3-1 1  Crater  initially  predicted  tile  damage  deeper  than  the  actual  tile  depth,  but  engineers 
used  their  judgment  to  conclude  that  damage  would  not  penetrate  the  densified  layer 
of  tile.  Similarly.  RCC  damage  conclusions  were  based  primarily  on  judgment  and 
experience  rather  than  analysis. 

F6.3-I2  For  a  variety  of  reasons,  including  management  failures,  communication  break- 
downs, inadequate  imagery,  inappropriate  use  of  assessment  tools,  and  flawed  engi- 
neering judgments,  the  damage  assessments  contained  substantial  uncertainties. 

F6.3-I3  The  assumptions  (and  their  uncertainties)  used  in  the  analysis  were  never  presented 
or  discussed  in  full  to  either  the  Mission  Evaluation  Room  or  the  Mission  Manage- 
ment Team. 

F6.3-14  While  engineers  and  managers  knew  the  foam  could  have  struck  RCC  panels:  the 
briefings  on  the  analysis  to  the  Mission  Evaluation  Room  and  Mission  Management 
Team  did  not  address  RCC  damage,  and  neither  Mission  Evaluation  Room  nor  Mis- 
sion Management  Team  managers  asked  about  it. 

Space  Shuttle  Program  Management 

F6.3-I5  There  were  lapses  in  leadership  and  communication  that  made  it  difficult  for  en- 
gineers to  raise  concerns  or  understand  decisions.  Management  failed  to  actively 
engage  in  the  analysis  of  potential  damage  caused  by  the  foam  strike. 

F6.3-I6  Mission  Management  Team  meetings  occurred  infrequently  (five  times  during  a  16 
day  mission),  not  every  day,  as  specified  in  Shuttle  Program  management  rules. 

F6.3-17  Shuttle  Program  Managers  entered  the  mission  with  the  belief,  recently  reinforced 
by  the  STS-1 13  Flight  Readiness  Review,  that  a  foam  strike  is  not  a  safety-of-flight 
issue. 
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F6.3- 1 8       After  Program  managers  learned  about  the  foam  strike,  their  belief  that  it  would  not 

be  a  problem  was  confirmed  (early,  and  without  analysis)  by  a  trusted  expert  who  was 

readily  accessible  and  spoke  from  "experience."  No  one  in  management  questioned 

this  conclusion. 
F6.3-I9       Managers  asked  "Who's  reqiiestini;  the  photos'/"  instead  of  assessing  the  merits  of 

the  request.  Management  seemed  more  concerned  about  the  staff  following  proper 

channels  (even  while  they  were  themselves  taking  informal  advice)  than  they  were 

about  the  analysis. 
F6.3-20      No  one  in  the  operational  chain  of  command  for  STS-107  held  a  security  clearance 

that  would  enable  them  to  understand  the  capabilities  and  limitations  of  National 

imagei7  resources. 
F6.3-2 1       Managers  associated  with  STS-107  began  investigating  the  implications  of  the  foam 

strike  on  the  launch  schedule,  and  took  steps  to  expedite  post-flight  analysis. 
F6.3-22       Program  managers  required  engineers  to  prove  that  the  debris  strike  created  a  safety- 

of-flight  issue:  that  is,  engineers  had  to  produce  evidence  that  the  system  was  unsafe 

rather  than  prove  that  it  was  safe. 
F6.3-23       In  both  the  Mission  Evaluation  Room  and  Mission  Management  Team  meetings  over 

the  Debris  Assessment  Team's  results,  the  focus  was  on  the  bottom  line  -  was  there 

a  safety-of-flight  issue,  or  not?  There  was  little  discussion  of  analysis,  assumptions, 

issues,  or  ramifications. 

Communication 

F6.3-24  /    Communication  did  not  flow  effectively  up  to  or  down  from  Program  managers. 

F6.3-25      Three  independent  requests  for  imagery  were  initiated. 

F6.3-26  Much  of  Program  managers"  information  came  through  informal  channels,  which 
prevented  relevant  opinion  and  analysis  from  reaching  decision  makers. 

F6.3-27  Program  Managers  did  not  actively  communicate  with  the  Debris  Assessment  Team. 
Partly  as  a  result  of  this,  the  Team  went  through  institutional,  not  mission-related, 
channels  with  its  request  for  imagery,  and  confusion  surrounded  the  origin  of  imag- 
ery requests  and  their  subsequent  denial. 

F6.3-28  Communication  was  stifled  by  the  Shuttle  Program  attempts  to  find  out  who  had  a 
"mandatory  requirement"  for  imagery. 

Safety  Representative's  Role 

F6.3-29  Safety  representatives  from  the  appropriate  organizations  attended  meetings  of  the 
Debris  Assessment  Team,  Mission  Evaluation  Room,  and  Mission  Management 
Team,  but  were  passive,  and  therefore  were  not  a  channel  through  which  to  voice 
concerns  or  dissenting  views. 

Recommendation: 

R6.3-1  Implement  an  expanded  training  program  in  which  the  Mission  Management  Team 
faces  potential  crew  and  vehicle  safety  contingences  beyond  launch  and  ascent. 
These  contingences  should  involve  potential  loss  of  Shuttle  or  crew,  contain  numer- 
ous uncertainties  and  unknowns,  and  require  the  Mission  Management  Team  to  as- 
semble and  interact  with  support  organizations  across  NASA/Contractor  lines  and  in 
various  locations. 

R6.3-2  Modify  the  Memorandum  of  Agreement  with  the  National  Imagery  and  Mapping 
Agency  (NIMA)  to  make  the  imaging  of  each  Shuttle  flight  while  on  orbit  a  standard 
requirement. 
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6.4    Possibility  of  Rescue  or  Repair 

To  put  the  decisions  made  during  the  tlight  of  STS-107  into 
perspective,  the  Board  asked  NASA  to  determine  if  there 
were  options  for  the  safe  return  of  the  STS-107  crew.  In  this 
study.  NASA  was  to  assume  that  the  extent  of  damage  to  the 
leading  edge  of  the  left  wing  was  detennined  b\  national 
imaging  assets  or  by  a  spacewalk.  NASA  was  then  asked  to 
evaluate  the  possibility  of; 

1.  Rescuing  the  STS-107  crew  by  launching  Atlantis. 
Atlaiiris  would  be  hurried  to  the  pad.  launched,  rendez- 
vous with  Coltinihia.  and  take  on  Coliinihia's  crew  for 
a  return.  It  was  assumed  that  NASA  would  be  willing 
to  expose  Atlantis  and  its  crew  to  the  same  possibil- 
ity of  External  Tank  bipod  foam  loss  that  damaged 
Colitnihia. 

2.  Repairing  damage  to  Columbia's  wing  on  orbit.  In  the 
repair  scenario,  astronauts  would  use  onboard  materi- 
als to  rig  a  temporar)  fix.  Some  of  Cohnnhia's  cargo 
might  be  jettisoned  and  a  different  re-entry  profile 
would  be  flown  to  lessen  heating  on  the  left  wing  lead- 
ing edge.  The  crew  would  be  prepared  to  bail  out  if  the 
wing  structure  was  predicted  to  fail  on  landing. 

In  its  study  of  these  two  options,  NASA  assumed  the  follow- 
ing timeline.  Following  the  debris  strike  discovery  on  Flight 
Day  Two,  Mission  Managers  requested  imagery  by  Flight 
Day  Three.  That  imagery  was  inconclusive,  leading  to  a  de- 
cision on  Flight  Day  Four  to  perform  a  spacewalk  on  Flight 
Day  Five.  That  spacewalk  revealed  potentially  catastrophic 
damage.  The  crew  was  directed  to  begin  conserving  con- 
sumables, such  as  oxygen  and  water,  and  Shuttle  managers 
began  around-the-clock  processing  of  Atlantis  to  prepare  it 
for  launch.  Shuttle  managers  pursued  both  the  rescue  and  the 
repair  options  from  Flight  Day  Six  to  Flight  Day  26,  and  on 
that  day  (February  10)  decided  which  one  to  abandon. 

The  NASA  team  deemed  this  timeline  realistic  for  sev- 
eral reasons.  First,  the  team  determined  that  a  spacewalk 
to  inspect  the  left  wing  could  be  easily  accomplished.  The 
team  then  assessed  how  the  crew  could  limit  its  use  of  con- 
sumables to  determine  how  long  Coliiiuhia  could  stay  in 
orbit.  The  limiting  consumable  was  the  lithium  hydroxide 
canisters,  which  scrub  from  the  cabin  atmosphere  the  carbon 
dioxide  the  crew  exhales.  After  consulting  with  flight  sur- 
geons, the  team  concluded  that  by  modifying  crew  activity 
and  sleep  time  carbon  dioxide  could  be  kept  to  acceptable 
levels  until  Flight  Day  30  (the  morning  of  February  15).  All 
other  consumables  would  last  longer  Oxygen,  the  next  most 
critical,  would  require  the  crew  to  return  on  Flight  Day  31. 

Repairing  Damage  On  Orbit 

The  repair  option  (see  Figure  6.4-1).  while  logistically  vi- 
able using  existing  materials  onboard  Columbia,  relied  on  so 
many  uncertainties  that  NASA  rated  this  option  "high  risk." 
To  complete  a  repair,  the  crew  would  perform  a  spacewalk  to 
fill  an  assumed  6-inch  hole  in  an  RCC  panel  with  heavy  met- 
al tools,  small  pieces  of  titanium,  or  other  metal  scavenged 
from  the  crew  cabin.  These  heavy  metals,  which  would  help 
protect  the  wing  structure,  would  be  held  in  place  during 


Figure  6.4-?.  The  speculative  repair  option  would  have  sent  astro- 
nauts hanging  over  the  payload  bay  door  to  reach  the  left  wing 
RCC  panels  using  o  ladder  scavenged  from  the  crew  module. 


re-enti7  by  a  water-filled  bag  that  had  turned  into  ice  in  the 
cold  of  space.  The  ice  and  metal  would  help  restore  wing 
leading  edge  geometry,  preventing  a  turbulent  airflow  over 
the  wing  and  therefore  keeping  heating  and  bum-through 
levels  low  enough  for  the  crew  to  survive  re-entry  and  bail 
out  before  landing.  Because  the  NASA  team  could  not  verify 
that  the  repairs  would  survive  even  a  modified  re-entry,  the 
rescue  option  had  a  considerably  higher  chance  of  bringing 
Columbia's  crew  back  alive. 

Rescuing  the  STS-107  Crew  with  Atlantis 

Accelerating  the  processing  of  Atlantis  for  early  launch  and 
rendezvous  with  Columbia  was  by  far  the  most  complex 
task  in  the  rescue  scenario.  On  Columbia's  Flight  Day  Four, 
Atlantis  was  in  the  Orbiter  Processing  Facility  at  Kennedy 
Space  Center  with  its  main  engines  installed  and  only  41 
days  from  its  scheduled  March  1  launch.  The  Solid  Rocket 
Boosters  were  already  mated  with  the  External  Tank  in  the 
Vehicle  Assembly  Building.  By  working  three  around-the- 
clock  shifts  seven  days  a  week,  Atlantis  could  be  readied  for 
launch,  with  no  necessary  testing  skipped,  by  February  10. 
If  launch  processing  and  countdown  proceeded  smoothly, 
this  would  provide  a  five-day  window,  from  February  10 
to  February  15,  in  which  Atlantis  could  rendezvous  with 
Columbia  before  Columbia's  consumables  ran  out.  Accord- 
ing to  records,  the  weather  on  these  days  allowed  a  launch. 
Atlantis  would  be  launched  with  a  crew  of  four:  a  command- 
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Figure  6.4-2.  The  rescue  option  had  Atlantis  flower  vehicle)  rendezvousing  with  Columbia  and  ffie  STS-107  crew  transferring  via  ropes.  Note 
that  the  payload  bay  of  Atlantis  is  empty  except  for  the  external  airlock/docking  adapter. 


er,  pilot,  and  two  astronauts  trained  for  spacewalks.  In  Janu- 
ary, seven  commanders,  seven  pilots,  and  nine  spacewalk- 
trained  astronauts  were  available.  During  the  rendezvous  on 
Atlantis's  first  day  in  orbit,  the  two  Orbiters  would  maneuver 
to  face  each  other  with  their  payload  bay  doors  open  (see 
Figure  6.4-2).  Suited  Coliiinhici  crew  members  would  then 
be  transferred  to  Atlantis  via  spacewalks.  AtUmtls  would 
return  with  four  crew  members  on  the  flight  deck  and  seven 
in  the  mid-deck.  Mission  Control  would  then  configure  Co- 
liiinhici for  a  de-orbit  burn  that  would  ditch  the  Orbiter  in  the 
Pacific  Ocean,  or  would  have  the  Columbia  crew  take  it  to  a 
higher  orbit  for  a  possible  subsequent  repair  mission  if  more 
thorough  repairs  could  be  developed. 

This  rescue  was  considered  challenging  but  feasible.  To 
succeed,  it  required  problem-free  processing  oi  Atlantis  and 
a  flawless  launch  countdown.  If  Program  managers  had  un- 
derstood the  threat  that  the  bipod  foam  strike  posed  and  were 
able  to  unequivocally  determine  before  Flight  Day  Seven 
that  there  was  potentially  catastrophic  damage  to  the  left 
wing,  these  repair  and  rescue  plans  would  most  likely  have 
been  developed,  and  a  rescue  would  have  been  conceivable. 
For  a  detailed  discussion  of  the  rescue  and  repair  options, 
see  Appendix  D.13. 


Findings: 


F6.4-1 


F6.4-2 


The  repair  option,  while  logistically  viable  using 
existing  materials  onboard  Coliinihia,  relied  on  so 
many  uncertainties  that  NASA  rated  this  option 
"high  risk." 

If  Program  managers  were  able  to  unequivocally 
determine  before  Flight  Day  Seven  that  there 


was  potentially  catastrophic  damage  to  the  left 
wing,  accelerated  processing  of  Atlantis  might 
have  provided  a  window  in  which  Atlantis  could 
rendezvous  with  Coliiinhia  before  Columbia's 
limited  consumables  ran  out. 

Recommendation: 

R6.4-1  For  missions  to  the  International  Space  Station, 
develop  a  practicable  capability  to  inspect  and 
effect  emergency  repairs  to  the  widest  possible 
range  of  damage  to  the  Thennal  Protection  Sys- 
tem, including  both  tile  and  Reinforced  Carbon- 
Carbon,  taking  advantage  of  the  additional  capa- 
bilities available  when  near  to  or  docked  at  the 
International  Space  Station. 

For  non-Station  missions,  develop  a  comprehen- 
sive autonomous  (independent  of  Station)  inspec- 
tion and  repair  capability  to  cover  the  widest 
possible  range  of  damage  scenarios. 

Accomplish  an  on-orbit  Thermal  Protection 
System  inspection,  using  appropriate  assets  and 
capabilities,  early  in  all  missions. 

The  ultimate  objective  should  be  a  fully  autono- 
mous capability  for  all  missions  to  address  the 
possibility  that  an  International  Space  Station 
mission  fails  to  achieve  the  correct  orbit,  fails  to 
dock  successfully,  or  is  damaged  during  or  after 
undocking. 
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Chapter  7 


The  Accident's 
Organizational  Causes 


Many  accident  investigations  maice  the  same  mistake  in 
defining  causes.  They  identify  the  widget  that  broke  or  mal- 
functioned, then  locate  the  person  most  closely  connected 
with  the  technical  failure:  the  engineer  who  miscalculated 
an  analysis,  the  operator  who  missed  signals  or  pulled  the 
wrong  switches,  the  supervisor  who  failed  to  listen,  or  the 
manager  who  made  bad  decisions.  When  causal  chains  are 
limited  to  technical  flaws  and  individual  failures,  the  ensu- 
ing responses  aimed  at  preventing  a  similar  event  in  the 
future  are  equally  limited:  they  aim  to  fix  the  technical  prob- 
lem and  replace  or  retrain  the  individual  responsible.  Such 
corrections  lead  to  a  misguided  and  potentially  disastrous 
belief  that  the  underlying  problem  has  been  solved.  The 
Board  did  not  want  to  make  these  errors.  A  central  piece  of 
our  expanded  cause  model  involves  NASA  as  an  organiza- 
tional whole. 

Organizational  Cause  Statement 

The  organizational  causes  of  this  accident  are  rooted 
in  the  Space  Shuttle  Program's  history  and  culture, 
including  the  original  compromises  that  were  re- 
quired to  gain  approval  for  the  Shuttle  Program, 
subsequent  years  of  resource  constraints,  fluctuafing 
priorities,  schedule  pressures,  mischaracterizafions  of 
the  Shuttle  as  operafional  rather  than  developmental, 
and  lack  of  an  agreed  nafional  vision.  Cultural  traits 
and  organizafional  practices  detrimental  to  safety 
and  reliability  were  allowed  to  develop,  including: 
reliance  on  past  success  as  a  subsfitute  for  sound 
engineering  pracfices  (such  as  testing  to  understand 
why  systems  were  not  performing  in  accordance  with 
requirements/specifications);  organizational  barriers 
which  prevented  effecfive  communication  of  crifical 
safety  informafion  and  stifled  professional  differences 
of  opinion;  lack  of  integrated  management  across 
program  elements;  and  trie  evolution  of  an  informal 
chain  of  command  and  decision-making  processes 
that  operated  outside  the  organization's  rules. 


Understanding  Causes 

In  the  Board's  view,  NASA's  organizational  culture  and 
structure  had  as  much  to  do  with  this  accident  as  the  Exter- 
nal Tank  foam.  Organizational  culture  refers  to  the  values, 
norms,  beliefs,  and  practices  that  govern  how  an  institution 
functions.  .At  the  most  basic  level,  organizational  culture 
defines  the  assumptions  that  employees  make  as  they  can^y 
out  their  work.  It  is  a  powerful  force  that  can  persist  through 
reorganizations  and  the  reassignment  of  key  personnel. 

Given  that  today's  risks  in  human  space  flight  are  as  high 
and  the  safety  margins  as  razor  thin  as  they  have  ever  been, 
there  is  little  room  for  overconfidence.  Yet  the  attitudes 
and  decision-making  of  Shuttle  Program  managers  and 
engineers  during  the  events  leading  up  to  this  accident  were 
clearly  overconfident  and  often  bureaucratic  in  nature.  They 
deferred  to  layered  and  cumbersome  regulations  rather  than 
the  fundamentals  of  safety.  The  Shuttle  Program's  safety 
culture  is  straining  to  hold  together  the  vestiges  of  a  once 
robust  systems  safety  program. 

As  the  Board  investigated  the  Columbia  accident,  it  expected 
to  find  a  vigorous  safety  organization,  process,  and  culture  at 
NASA,  bearing  little  resemblance  to  what  the  Rogers  Com- 
mission identified  as  the  ineffective  "silent  safety"  system  in 
which  budget  cuts  resulted  in  a  lack  of  resources,  personnel, 
independence,  and  authority.  NASA's  initial  briefings  to  the 
Board  on  its  safety  programs  espoused  a  risk-averse  philoso- 
phy that  empowered  any  employee  to  stop  an  operation  at  the 
mere  glimmer  of  a  problem.  Unfortunately.  NASA's  views 
of  its  safety  culture  in  those  briefings  did  not  reflect  reality. 
Shuttle  Program  safety  personnel  failed  to  adequately  assess 
anomalies  and  frequently  accepted  critical  risks  without 
qualitative  or  quantitative  support,  even  when  the  tools  to 
provide  more  comprehensive  assessments  were  available. 

Similarly,  the  Board  expected  to  find  NASA's  Safety  and 
Mission  Assurance  organization  deeply  engaged  at  every 
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level  of  Shuttle  management:  the  Flight  Readiness  Review, 
the  Mission  Management  Team,  the  Debris  Assessment 
Team,  the  Mission  Evaluation  Room,  and  so  forth.  This 
was  not  the  case.  In  briefing  after  briefing,  interview  after 
interview,  NASA  remained  in  denial:  in  the  agency's  eyes, 
"there  were  no  safety-of-flight  issues,"  and  no  safety  com- 
promises in  the  long  history  of  debris  strikes  on  the  Ther- 
mal Protection  System.  The  silence  of  Program-level  safety 
processes  undermined  oversight;  when  they  did  not  speak 
up,  safety  personnel  could  not  fulfill  their  stated  mission 
to  provide  "checks  and  balances."  A  pattern  of  acceptance 
prevailed  throughout  the  organization  that  tolerated  foam 
problems  without  sufficient  engineering  justification  for 
doing  so. 

This  chapter  presents  an  organizational  context  for  under- 
standing the  Columbia  accident.  Section  7.1  outlines  a  short 
history  of  safety  at  NASA,  beginning  in  the  pre-Apollo  era 
when  the  agency  reputedly  had  the  finest  system  safety- 
engineering  programs  in  the  world.  Section  7.2  discusses 
organizational  theory  and  its  importance  to  the  Board's  in- 
vestigation, and  Section  7.3  examines  the  practices  of  three 
organizations  that  successfully  manage  high  risk.  Sections 
7.4  and  7.5  look  at  NASA  today  and  answer  the  question, 
"How  could  NASA  have  missed  the  foam  signal?"  by  high- 
lighting the  blind  spots  that  rendered  the  Shuttle  Program's 
risk  perspective  myopic.  The  Board's  conclusion  and  rec- 
ommendations are  presented  in  7.6.  (See  Chapter  10  for  a 
discussion  of  the  differences  between  industrial  safety  and 
mission  assurance/quality  assurance.) 

7.1     Organizational  Causes:  Insights  from 
History 

NASA's  organizational  culture  is  rooted  in  history  and  tradi- 
tion. From  NASA's  inception  in  1958  to  the  Cludleiiiier  ac- 
cident in  1986,  the  agency's  Safety,  Reliability,  and  Quality 
Assurance  (SRQA)  activities,  "although  distinct  disciplines," 
were  "typically  treated  as  one  function  in  the  design,  devel- 
opment, and  operations  of  NASA's  manned  space  flight 
programs."'  Contractors  and  NASA  engineers  collaborated 
closely  to  assure  the  safety  of  human  space  flight.  Solid  en- 
gineering practices  emphasized  defining  goals  and  relating 
system  performance  to  them;  establishing  and  using  decision 
criteria;  developing  alternatives;  modeling  systems  for  analy- 
sis; and  managing  operations.-  Although  a  NASA  Office  of 
Reliability  and  Quality  Assurance  existed  for  a  short  time 
during  the  early  1960s,  it  was  funded  by  the  human  space 
flight  program.  By  1963,  the  office  disappeared  from  the 
agency's  organization  charts.  For  the  next  few  years,  the  only 
type  of  safety  program  that  existed  at  NASA  was  a  decentral- 
ized "loose  federation"  of  risk  assessment  oversight  mn  by 
each  program's  contractors  and  the  project  offices  at  each  of 
the  three  Human  Space  Flight  Centers. 

Fallout  from  Apollo  -  1967 

In  January  1967,  months  before  the  scheduled  launch  of 
Apollo  y,  three  astronauts  died  when  a  fire  erupted  in  a 
ground-test  capsule.  In  response.  Congress,  seeking  to 
establish  an  independent  safety  organization  to  oversee 
space  flight,  created  the  Aerospace  Safety  Advisory  Panel 


(ASAP).  The  ASAP  was  intended  to  be  a  senior  advisory 
committee  to  NASA,  reviewing  space  flight  safety  studies 
and  operations  plans,  and  evaluating  ".systems  procedures 
and  management  policies  that  contribute  to  risk."  The 
panel's  main  priority  was  human  space  flight  missions.^ 
Although  four  of  the  panel's  nine  members  can  be  NASA 
employees,  in  recent  years  few  have  served  as  members. 
While  the  panel's  support  staff  generally  consists  of  full- 
time  NASA  employees,  the  group  technically  remains  an 
independent  oversight  body. 

Congress  simultaneously  mandated  that  NASA  create  sepa- 
rate safety  and  reliability  offices  at  the  agency's  headquar- 
ters and  at  each  of  its  Human  Space  Flight  Centers  and  Pro- 
grams. Overall  safety  oversight  became  the  responsibility 
of  NASA's  Chief  Engineer.  Although  these  offices  were  not 
totally  independent  -  their  funding  was  linked  with  the  very 
programs  they  were  supposed  to  oversee  -  their  existence 
allowed  NASA  to  treat  safety  as  a  unique  function.  Until  the 
Challenger  accident  in  1986,  NASA  safety  remained  linked 
organizationally  and  financially  to  the  agency's  Human 
Space  Flight  Program. 

ChaWenger  -  1986 

In  the  aftermath  of  the  Challenger  accident,  the  Rogers 
Commission  issued  recommendations  intended  to  remedy 
what  it  considered  to  be  basic  deficiencies  in  NASA's  safety 
system.  These  recommendations  centered  on  an  underlying 
theme;  the  lack  of  independent  safety  oversight  at  NASA. 
Without  independence,  the  Commission  believed,  the  slate 
of  safety  failures  that  contributed  to  the  Challenger  accident 
-  such  as  the  undue  influence  of  schedule  pressures  and  the 
flawed  Flight  Readiness  process  -  would  not  be  corrected. 
"NASA  should  establish  an  Office  of  Safety,  Reliability, 
and  Quality  Assurance  to  be  headed  by  an  Associate  Ad- 
ministrator, reporting  directly  to  the  NASA  Administrator," 
concluded  the  Commission.  "It  would  have  direct  authority 
for  safety,  reliability,  and  quality  assurance  throughout  the 
Agency.  The  office  should  be  assigned  the  workforce  to 
ensure  adequate  oversight  of  its  functions  and  should  be 
independent  of  other  NASA  functional  and  program  respon- 
sibilities" [emphasis  added). 

In  July  1986,  NASA  Administrator  James  Fletcher  created  a 
Headquarters  Office  of  Safety,  Reliability,  and  Quality  As- 
surance, which  was  given  responsibility  for  all  agency-wide 
safety-related  policy  functions.  In  the  process,  the  position  of 
Chief  Engineer  was  abolished."*  The  new  office's  Associate 
Administrator  promptly  initiated  studies  on  Shuttle  in-flight 
anomalies,  overtime  levels,  the  lack  of  spare  parts,  and  land- 
ing and  crew  safety  systems,  among  other  issues."  Yet  NASA's 
response  to  the  Rogers  Commission  recommendation  did  not 
meet  the  Commission's  intent:  the  Associate  .Administrator 
did  not  have  direct  authority,  and  safety,  reliability,  and  mis- 
sion assurance  activities  across  the  agency  remained  depen- 
dent on  other  programs  and  Centers  for  funding. 

General  Accounting  Office  Reviev/  -  1990 

A  1990  review  by  the  U.S.  General  Accounting  Office 
questioned  the  effectiveness  of  NASA's  new  safety  organi- 
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zations  in  a  report  titled  "Space  Program  Safety:  Funding 
for  NASA's  Safety  Organizations  Should  Be  Centralized."'" 
The  report  concluded  "NASA  did  not  have  an  independent 
and  effective  safety  organization"  [emphasis  added].  Al- 
though the  safety  organizational  structure  may  have  "ap- 
peared adequate."  in  the  late  1980s  the  space  agency  had 
concentrated  most  of  its  efforts  on  creating  an  independent 
safety  office  at  NASA  Headquarters.  In  contrast,  the  safety 
offices  at  NASA's  field  centers  "were  not  entirely  indepen- 
dent because  they  obtained  most  of  their  funds  from  activi- 
ties whose  safety-related  performance  they  were  responsible 
for  overseeing."  The  General  Accounting  Office  worried 
that  "the  lack  of  centralized  independent  funding  may  also 
restrict  the  flexibility  of  center  safety  managers."  It  also 
suggested  "most  NASA  safety  managers  believe  that  cen- 
tralized SRM&QA  [Safety,  Reliability.  Maintainability  and 
Quality  Assurance]  funding  would  ensure  independence." 
NASA  did  not  institute  centralized  funding  in  response  to 
the  General  Accounting  Office  report,  nor  has  it  since.  The 
problems  outlined  in  1990  persist  to  this  day. 

Space  Flight  Operations  Contract  -  1996 

The  Space  Flight  Operations  Contract  was  intended  to 
streamline  and  modernize  NASA's  cumbersome  contracting 
practices,  thereby  freeing  the  agency  to  focus  on  research 
and  development  (see  Chapter  5).  Yet  its  implementation 
complicated  issues  of  safety  independence.  A  single  contrac- 
tor would,  in  principle,  provide  "oversight"  on  production, 
safety,  and  mission  assurance,  as  well  as  cost  management, 
while  NASA  maintained  "insight"  into  safety  and  quality 
assurance  through  reviews  and  metrics.  Indeed,  the  reduc- 
tion to  a  single  primary  contract  simplified  some  aspects  of 
the  NASA/contractor  interface.  However,  as  a  result,  e.\- 
perienced  engineers  changed  jobs.  NASA  grew  dependent 
on  contractors  for  technical  support,  contract  monitoring 
requirements  increased,  and  positions  were  subsequently 
staffed  by  less  experienced  engineers  who  were  placed  in 
management  roles. 

Collectively,  this  eroded  NASA's  in-house  engineering 
and  technical  capabilities  and  increased  the  agency's  reli- 
ance on  the  United  Space  Alliance  and  its  subcontractors 
to  identify,  track,  and  resolve  problems.  The  contract  also 
involved  substantial  transfers  of  safety  responsibility  from 
the  government  to  the  private  sector;  rollbacks  of  tens  of 
thousands  of  Government  Mandated  Inspection  Points; 
and  vast  reductions  in  NASA's  in-house  safety-related 
technical  expertise  (see  Chapter  10).  In  the  aggregate,  these 
mid-1990s  transformations  rendered  NASA's  already  prob- 
lematic safety  system  simultaneously  weaker  and  more 
complex. 

The  effects  of  transitioning  Shuttle  operations  to  the  Space 
Flight  Operations  Contract  were  not  immediately  apparent 
in  the  years  following  implementation.  In  November  1996, 
as  the  contract  was  being  implemented,  the  Aerospace 
Safety  Advisory  Panel  published  a  comprehensive  contract 
review,  which  concluded  that  the  effort  "to  streamline  the 
Space  Shuttle  program  has  not  inadvertently  created  unac- 
ceptable flight  or  ground  risks. "^  The  Aerospace  Safety  Ad- 
visory Panel's  passing  grades  proved  temporary. 


Shuttle  Independent  Assessment  Team  -  1999 

Just  three  years  later,  after  a  number  of  close  calls,  NASA 
chartered  the  Shuttle  Independent  Assessment  Team  to 
examine  Shuttle  sub-systems  and  maintenance  practices 
(see  Chapter  5).  The  Shuttle  Independent  Assessment  Team 
Report  sounded  a  stem  warning  about  the  quality  of  NASA's 
Safety  and  Mission  Assurance  efforts  and  noted  that  the 
Space  Shuttle  Program  had  undergone  a  massive  change  in 
structure  and  was  transitioning  to  "a  slimmed  down,  con- 
tractor-run operation." 

The  team  produced  several  pointed  conclusions:  the  Shuttle 
Program  was  inappropriately  iisin}>  previous  success  as 
a  justification  for  accepting  increased  risk;  the  Shuttle 
Program's  ahilir\'  to  manage  risk  was  being  eroded  "by  the 
desire  to  reduce  costs;"  the  size  and  complexity  of  the  Shut- 
tle Program  and  NASA/contractor  relationships  demanded 
better  connnunication  practices:  NASA's  safety  and  mission 
assurance  organization  was  not  siifficientlx  independent:  and 
"the  workforce  has  received  a  conflicting  message  due  to 
the  emphasis  on  achieving  cost  and  staff  reductions,  and  the 
pressures  placed  on  increasing  scheduled  fiights  as  a  result 
of  the  Space  Station"  [emphasis  added].**  The  Shuttle  Inde- 
pendent Assessment  Team  found  failures  of  communication 
to  flow  up  from  the  "shop  floor"  and  down  from  supervisors 
to  workers,  deficiencies  in  problem  and  waiver-tracking 
systems,  potential  conflicts  of  interest  between  Program  and 
contractor  goals,  and  a  general  failure  to  communicate  re- 
quirements and  changes  across  organizations.  In  general,  the 
Program's  organizational  culture  was  deemed  "too  insular."' 

NASA  subsequently  formed  an  Integrated  Action  Team  to 
develop  a  plan  to  address  the  recommendations  from  pre- 
vious Program-specific  assessments,  including  the  Shuttle 
Independent  Assessment  Team,  and  to  formulate  improve- 
ments.'" In  part  this  effort  was  also  a  response  to  program 
missteps  in  the  drive  for  efficiency  seen  in  the  "faster,  better, 
cheaper"  NASA  of  the  1990s.  The  NASA  Integrated  Action 
Team  observed:  "NASA  should  continue  to  remove  commu- 
nication barriers  and  foster  an  inclusive  environment  where 
open  comnunucation  is  the  norm."  The  intent  was  to  estab- 
lish an  initiative  where  "the  importance  of  communication 
and  a  culture  of  trust  and  openness  permeate  all  facets  of  the 
organization."  The  report  indicated  that  "multiple processes 
to  get  the  messages  across  the  organizational  structure" 
would  need  to  be  explored  and  fostered  [emphasis  added]. 
The  report  recommended  that  NASA  solicit  expert  advice  in 
identifying  and  removing  barriers,  providing  tools,  training, 
and  education,  and  facilitating  communication  processes. 

The  Shuttle  Independent  Assessment  Team  and  NASA  Inte- 
grated Action  Team  findings  mirror  those  presented  by  the 
Rogers  Commission.  The  same  communication  problems 
persisted  in  the  Space  Shuttle  Program  at  the  time  of  the 
Columbia  accident. 

Space  Shuttle  Competitive  Source 
Task  Force  -  2002 

In  2002,  a  I4-member  Space  Shuttle  Competitive  Task 
Force  supported  by  the  RAND  Corporation  examined  com- 
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petitive  sourcing  options  for  the  Shuttle  Program.  In  its  final 
report  to  NASA,  the  team  highlighted  several  safety-related 
concerns,  which  the  Board  shares: 

•  Flight  and  ground  hardware  and  software  are  obsolete, 
and  safety  upgrades  and  aging  infrastructure  repairs 
have  been  deferred. 

•  Budget  constraints  have  impacted  personnel  and  re- 
sources required  for  maintenance  and  upgrades. 

•  International  Space  Station  schedules  exert  significant 
pressures  on  the  Shuttle  Program. 

•  Certain  mechanisms  may  impede  worker  anonymity  in 
reporting  safety  concerns. 

•  NASA  does  not  have  a  truly  independent  safety  function 
with  the  authority  to  halt  the  progress  of  a  critical  mis- 
sion element. " 

Based  on  these  findings,  the  task  force  suggested  that  an  In- 
dependent Safety  Assurance  function  should  be  created  that 
would  hold  one  of  "three  keys"  in  the  Certification  of  Flight 
Readiness  process  (NASA  and  the  operating  contractor 
would  hold  the  other  two),  effectively  giving  this  function 
the  ability  to  stop  any  launch.  Although  in  the  Board's  view 
the  "third  key"  Certification  of  Flight  Readiness  process  is 
not  a  perfect  solution,  independent  safety  and  verification 
functions  are  vital  to  continued  Shuttle  operations.  This 
independent  function  should  possess  the  authority  to  shut 
down  the  flight  preparation  processes  or  intervene  post- 
launch  when  an  anomaly  occurs. 

7.2    Organizational  Causes:  Insights  from 
Theory 

To  develop  a  thorough  understanding  of  accident  causes  and 
risk,  and  to  better  interpret  the  chain  of  events  that  led  to  the 
CdliiDihia  accident,  the  Board  turned  to  the  contemporai-y 
social  science  literature  on  accidents  and  risk  and  sought 
insight  from  experts  in  High  Reliability,  Normal  Accident, 
and  Organizational  Theory.'-  Additionally,  the  Board  held  a 
forum,  organized  by  the  National  Safety  Council,  to  define 
the  essential  characteristics  of  a  sound  safety  program." 

High  Reliability  Theory  argues  that  organizations  operating 
high-risk  technologies,  if  properly  designed  and  managed, 
can  compensate  for  inevitable  human  shortcomings,  and 
therefore  avoid  mistakes  that  under  other  circumstances 
would  lead  to  catastrophic  failures.'^  Normal  Accident 
Theory,  on  the  other  hand,  has  a  more  pessimistic  view  of 
the  ability  of  organizations  and  their  members  to  manage 
high-risk  technology.  Normal  Accident  Theory  holds  that 
organizational  and  technological  complexity  contributes 
to  failures.  Organizations  that  aspire  to  failure-free  perfor- 
mance are  inevitably  doomed  to  fail  because  of  the  inherent 
risks  in  the  technology  they  operate.'^  Normal  Accident 
models  also  emphasize  systems  approaches  and  systems 
thinking,  while  the  High  Reliability  model  works  from  the 
bottom  up:  if  each  component  is  highly  reliable,  then  the 
system  will  be  highly  reliable  and  safe. 

Though  neither  High  Reliability  Theory  nor  Normal  Ac- 
cident Theory  is  entirely  appropriate  for  understanding 
this  accident,  insights  from  each  figured  prominently  in  the 


Board's  deliberation.  Fundamental  to  each  theory  is  the  im- 
portance of  strong  organizational  culture  and  commitment  to 
building  successful  safely  strategies. 

The  Board  selected  certain  well-known  traits  from  these 
models  to  use  as  a  yardstick  to  assess  the  Space  Shuttle 
Program,  and  found  them  particularly  useful  in  shaping  its 
views  on  whether  NASA's  current  organization  of  its  Hu- 
man Space  Flight  Program  is  appropriate  for  the  remaining 
years  of  Shuttle  operation  and  beyond.  Additionally,  organi- 
zational theory,  which  encompasses  organizational  culture, 
structure,  history,  and  hierarchy,  is  used  to  explain  the 
Coliinihia  accident,  and,  ultimately,  combines  with  Chapters 
5  and  6  to  produce  an  expanded  explanation  of  the  accident's 
causes."'  The  Board  believes  the  following  considerations 
are  critical  to  understand  what  went  wrong  during  STS-I()7. 
They  will  become  the  central  motifs  of  the  Board's  analysis 
later  in  this  chapter. 

•  Commitment  to  a  Safety  Culture:  NASA's  safety  cul- 
ture has  become  reactive,  complacent,  and  dominated 
by  unjustified  optimism.  Over  time,  slowly  and  unin- 
tentionally, independent  checks  and  balances  intended 
to  increase  safety  have  been  eroded  in  favor  of  detailed 
processes  that  produce  massive  amounts  of  data  and 
unwarranted  consensus,  but  little  effective  communica- 
tion. Organizations  that  successfully  deal  with  high-risk 
technologies  create  and  sustain  a  disciplined  safety  sys- 
tem capable  of  identifying,  analyzing,  and  controlling 
hazards  throughout  a  technology's  life  cycle. 

•  Ability  to  Operate  in  Both  a  Centralized  and  Decen- 
tralized Manner:  The  ability  to  operate  in  a  centralized 
manner  when  appropriate,  and  to  operate  in  a  decentral- 
ized manner  when  appropriate,  is  the  hallmark  of  a 
high-reliability  organization.  On  the  operational  side, 
the  Space  Shuttle  Program  has  a  highly  centralized 
structure.  Launch  commit  criteria  and  flight  rules  gov- 
ern every  imaginable  contingency.  The  Mission  Control 
Center  and  the  Mission  Management  Team  have  very 
capable  decentralized  processes  to  solve  problems  that 
are  not  covered  by  such  rules.  The  process  is  so  highly 
regarded  that  it  is  considered  one  of  the  best  problem- 
solving  organizations  of  its  type.''  In  these  situations, 
mature  processes  anchor  rules,  procedures,  and  routines 
to  make  the  Shuttle  Program's  matrixed  workforce 
.seamless,  at  least  on  the  surface. 

Nevertheless,  it  is  evident  that  the  position  one  occupies 
in  this  structure  makes  a  difference.  When  supporting 
organizations  try  to  "push  back"  against  centralized 
Program  direction  -  like  the  Debris  Assessment  Team 
did  during  STS-107  -  independent  analysis  gener- 
ated by  a  decentralized  decision-making  process  can 
be  stifled.  The  Debris  Assessment  Team,  working  in  an 
essentially  decentralized  format,  was  well-led  and  had 
the  right  expertise  to  work  the  problem,  but  their  charter 
was  "fuzzy,"  and  the  team  had  little  direct  connection 
to  the  Mission  Management  Team.  This  lack  of  connec- 
tion to  the  Mission  Management  Team  and  the  Mi.ssion 
Evaluation  Room  is  the  single  most  compelling  reason 
why  communications  were  so  poor  during  the  debris 
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assessment.  In  this  case,  the  Shuttle  Program  was  un- 
able to  simultaneously  manage  both  the  centralized  and 
decentralized  systems. 

•  Importance  of  Communication:  At  every  juncture 
of  STS-107.  the  Shuttle  Program's  structure  and  pro- 
cesses, and  therefore  the  managers  in  charge,  resisted 
new  information.  Early  in  the  mission,  it  became  clear 
that  the  Program  was  not  going  to  authorize  imaging  of 
the  Orbiter  because,  in  the  Program's  opinion,  images 
were  not  needed.  Overwhelming  evidence  indicates  that 
Program  leaders  decided  the  foam  strike  was  merely  a 
maintenance  problem  long  before  any  analysis  had  be- 
gun. Every  manager  knew  the  party  line:  "we'll  wait  for 
the  analysis  -  no  safety-of-flight  issue  expected."  Pro- 
gram leaders  spent  at  least  as  much  time  making  sure 
hierarchical  rules  and  processes  were  followed  as  they 
did  trying  to  establish  why  anyone  would  want  a  picture 
of  the  Orbiter.  These  attitudes  are  incompatible  with  an 
organization  that  deals  with  high-risk  technology. 

•  Avoiding  Oversimplification:  The  Columbia  accident 
is  an  unfortunate  illustration  of  how  NASA's  strong 
cultural  bias  and  its  optimistic  organizational  think- 
ing undermined  effective  decision-making.  Over  the 
course  of  22  years,  foam  strikes  were  normalized  to  the 
point  where  they  were  simply  a  "maintenance"  issue 
-  a  concern  that  did  not  threaten  a  mission's  success. 
This  oversimplification  of  the  threat  posed  by  foam 
debris  rendered  the  issue  a  low-level  concern  in  the 
minds  of  Shuttle  managers.  Ascent  risk,  so  evident  in 
Cluilleiii^er.  biased  leaders  to  focus  on  strong  signals 
from  the  Shuttle  System  Main  Engine  and  the  Solid 
Rocket  Boosters.  Foam  strikes,  by  comparison,  were 
a  weak  and  consequently  overlooked  signal,  although 
they  turned  out  to  be  no  less  dangerous. 

•  Conditioned  by  Success:  Even  after  it  was  clear  from 
the  launch  videos  that  foam  had  struck  the  Orbiter  in  a 
manner  never  beft)re  seen.  Space  Shuttle  Program  man- 
agers were  not  unduly  alarmed.  They  could  not  imagine 
why  anyone  would  want  a  photo  of  something  that 
could  be  fixed  after  landing.  Mt)re  importantly,  learned 
attitudes  about  foam  strikes  diminished  management's 
wariness  of  their  danger.  The  Shuttle  Program  turned 
"the  experience  of  failure  into  the  memory  of  suc- 
cess.""*  Managers  also  failed  to  develop  simple  con- 
tingency plans  for  a  re-entry  emergency.  They  were 
convinced,  without  study,  that  nothing  could  be  done 
about  such  an  emergency.  The  intellectual  curiosity  and 
skepticism  that  a  solid  safety  culture  requires  was  al- 
most entirely  absent.  Shuttle  managers  did  not  embrace 
safety-conscious  attitudes.  Instead,  their  attitudes  were 
shaped  and  reinforced  by  an  organization  that,  in  this  in- 
stance, was  incapable  of  stepping  back  and  gauging  its 
biases.  Bureaucracy  and  process  trumped  thoroughness 
and  reason. 

•  Significance  of  Redundancy:  The  Human  Space  Flight 
Program  has  compromised  the  many  redundant  process- 
es, checks,  and  balances  that  should  identify  and  correct 
small   errors.    Redundant   systems  essential   to  every 


high-risk  enterprise  have  fallen  victim  to  bureaucratic 
efficiency.  Years  of  workforce  reductions  and  outsourc- 
ing have  culled  from  NASA's  workforce  the  layers  of 
experience  and  hands-on  systems  knowledge  that  once 
provided  a  capacity  for  safety  oversight.  Safety  and 
Mission  Assurance  personnel  have  been  eliminated,  ca- 
reers in  safety  have  lost  organizational  prestige,  and  the 
Program  now  decides  on  its  own  how  much  safety  and 
engineering  oversight  it  needs.  .Aiming  to  align  its  in- 
spection regime  with  the  International  Organization  for 
Standardization  9000/9001  protocol,  commonly  used  in 
industrial  environments  -  environments  vei7  different 
than  the  Shuttle  Program  -  the  Human  Space  Flight 
Program  shifted  from  a  comprehensive  "oversight" 
inspection  process  to  a  more  limited  "insight"  process, 
cutting  mandatory  inspection  points  by  more  than  half 
and  leaving  even  fewer  workers  to  make  "second"  or 
"third"  Shuttle  systems  checks  (see  Chapter  10). 

Implications  for  the  Shuttle  Program  Organization 

The  Board's  investigation  into  the  Columbia  accident  re- 
vealed two  major  causes  with  which  NASA  has  to  contend: 
one  technical,  the  other  organizational.  As  mentioned  earlier, 
the  Board  studied  the  two  dominant  theories  on  complex  or- 
ganizations and  accidents  involving  high-risk  technologies. 
These  schools  of  thought  were  influential  in  shaping  the 
Board's  organizational  recommendations,  primarily  because 
each  takes  a  different  approach  to  understanding  accidents 
and  risk. 

The  Board  determined  that  high-reliability  theory  is  ex- 
tremely useful  in  describing  the  culture  that  should  exist  in 
the  human  space  flight  organization.  NASA  and  the  Space 
Shuttle  Program  must  be  committed  to  a  strong  safety 
culture,  a  view  that  serious  accidents  can  be  prevented,  a 
willingness  to  learn  from  mistakes,  from  technology,  and 
from  others,  and  a  realistic  training  program  that  empowers 
employees  to  know  when  to  decentralize  or  centralize  prob- 
lem-solving. The  Shuttle  Program  cannot  afford  the  mindset 
that  accidents  are  inevitable  because  it  may  lead  to  unneces- 
sarily accepting  known  and  preventable  risks. 

The  Board  believes  normal  accident  theory  has  a  key  role 
in  human  spaceflight  as  well.  Complex  organizations  need 
specific  mechanisms  to  maintain  their  commitment  to  safety 
and  assist  their  understanding  of  how  complex  interactions 
can  make  organizations  accident-prone.  Organizations  can- 
not put  blind  faith  into  redundant  warning  systems  because 
they  inherently  create  more  complexity,  and  this  complexity 
in  turn  often  produces  unintended  system  interactions  that 
can  lead  to  failure.  The  Human  Space  Flight  Program  must 
realize  that  additional  protective  layers  are  not  always  the 
best  choice.  The  Program  must  also  remain  sensitive  to  the 
fact  that  despite  its  best  intentions,  managers,  engineers, 
safety  professionals,  and  other  employees,  can.  when  con- 
fronted with  extraordinary  demands,  act  in  counterproduc- 
tive ways. 

The  challenges  to  failure-free  performance  highlighted  by 
these  two  theoretical  approaches  will  always  be  present  in 
an  organization  that  aims  to  send  humans  into  space.  What 
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can  the  Program  do  about  these  difficulties?  The  Board  con- 
sidered three  alternatives.  First,  the  Board  could  recommend 
that  NASA  follow  traditional  paths  to  improving  safety  by 
making  changes  to  policy,  procedures,  and  processes.  These 
initiatives  could  improve  organizational  culture.  The  analy- 
sis provided  by  experts  and  the  literature  leads  the  Board 
to  conclude  that  although  reforming  management  practices 
has  certain  merits,  it  also  has  critical  limitations.  Second,  the 
Board  could  recommend  that  the  Shuttle  is  simply  too  risky 
and  should  be  grounded.  As  will  be  discussed  in  Chapter 
9,  the  Board  is  committed  to  continuing  human  space  ex- 
ploration, and  believes  the  Shuttle  Program  can  and  should 
continue  to  operate.  Finally,  the  Board  could  recommend  a 
significant  change  to  the  organizational  structure  that  con- 
trols the  Space  Shuttle  Program's  technology.  As  will  be 
discussed  at  length  in  this  chapter's  conclusion,  the  Board 
believes  this  option  has  the  best  chance  to  successfully  man- 
age the  complexities  and  risks  of  human  space  flight. 

7.3    Organizational  Causes:  Evaluating  Best 
Safety  Practices 

Many  of  the  principles  of  solid  safety  practice  identified  as 
crucial  by  independent  reviews  of  NASA  and  in  accident 
and  risk  literature  are  exhibited  by  organizations  that,  like 
NASA,  operate  risky  technologies  with  little  or  no  margin 
for  error.  While  the  Board  appreciates  that  organizations 
dealing  with  high-risk  technology  cannot  sustain  accident- 
free  performance  indefinitely,  evidence  suggests  that  there 
are  effective  ways  to  minimize  risk  and  limit  the  number  of 
accidents. 

in  this  section,  the  Board  compares  NASA  to  three  specific 
examples  of  independent  safety  programs  that  have  strived 
for  accident-free  performance  and  have,  by  and  large, 
achieved  it:  the  U.S.  Navy  Submarine  Flooding  Prevention 
and  Recovery  (SUBSAFE),  Naval  Nuclear  Propulsion  (Na- 
val Reactors)  programs,  and  the  Aerospace  Corporation's 
Launch  Verification  Process,  which  supports  U.S.  Air  Force 
space  launches.'''  The  safety  cultures  and  organizational 
stmcture  of  all  three  make  them  highly  adept  in  dealing 
with  inordinately  high  risk  by  designing  hardware  and  man- 
agement systems  that  prevent  seemingly  inconsequential 
failures  from  leading  to  major  accidents.  Although  size, 
complexity,  and  missions  in  these  organizations  and  NASA 
differ,  the  following  comparisons  yield  valuable  lessons  for 
the  space  agency  to  consider  when  re-designing  its  organiza- 
tion to  increase  safety. 

Navy  Submarine  and  Reactor  Safety  Programs 

Human  space  flight  and  submarine  programs  share  notable 
similarities.  Spacecraft  and  submarines  both  operate  in  haz- 
ardous environments,  use  complex  and  dangerous  systems, 
and  perform  missions  of  critical  national  significance.  Both 
NASA  and  Navy  operational  experience  include  failures  (for 
example,  USS  Thresher,  USS  Scorpion,  Apollo  I  capsule 
fire.  Challenger,  and  Columbia).  Prior  to  the  Columbia  mis- 
hap. Administrator  Sean  O'Keefe  initiated  the  NASA/Navy 
Benchmarking  Exchange  to  compare  and  contrast  the  pro- 
grams, specifically  in  safety  and  mission  assurance.-" 


The  Navy  SUBSAFE  and  Naval  Reactor  programs  exercise 
a  high  degree  of  engineering  discipline,  emphasize  total 
responsibility  of  individuals  and  organizations,  and  provide 
redundant  and  rapid  means  of  communicating  problems 
to  decision-makers.  The  Navy's  nuclear  safety  program 
emerged  with  its  first  nuclear-powered  warship  (USS  Nau- 
tilus), while  non-nuclear  SUBSAFE  practices  evolved  from 
from  past  flooding  mishaps  and  philosophies  first  introduced 
by  Naval  Reactors.  The  Navy  lost  two  nuclear-powered 
submarines  in  the  1960s  -  the  USS  Thresher  in  1963  and 
the  Scorpion  1968  -  which  resulted  in  a  renewed  effort  to 
prevent  accidents.-'  The  SUBSAFE  program  was  initiated 
just  two  months  after  the  Thresher  mishap  to  identify  criti- 
cal changes  to  submarine  certification  requirements.  Until  a 
ship  was  independently  recertified,  its  operating  depth  and 
maneuvers  were  limited.  SUBSAFE  proved  its  value  as  a 
means  of  verifying  the  readiness  and  safety  of  submarines, 
and  continues  to  do  so  today. -^ 

The  Naval  Reactor  Program  is  a  joint  Navy/Department 
of  Energy  organization  responsible  for  all  aspects  of  Navy 
nuclear  propulsion,  including  research,  design,  construction, 
testing,  training,  operation,  maintenance,  and  the  disposi- 
tion of  the  nuclear  propulsion  plants  onboard  many  Naval 
ships  and  submarines,  as  well  as  their  radioactive  materials. 
Although  the  naval  fleet  is  ultimately  responsible  for  day- 
to-day  operations  and  maintenance,  those  operations  occur 
within  parameters  established  by  an  entirely  independent 
division  of  Naval  Reactors. 

The  U.S.  nuclear  Navy  has  more  than  5,500  reactor  years  of 
experience  without  a  reactor  accident.  Put  another  way,  nu- 
clear-powered warships  have  steamed  a  cumulative  total  of 
over  127  million  miles,  which  is  roughly  equivalent  to  over 
265  lunar  roundtrips.  In  contrast,  the  Space  Shuttle  Program 
has  spent  about  three  years  on-orbit,  although  its  spacecraft 
have  traveled  some  420  million  miles. 

Naval  Reactor  success  depends  on  several  key  elements: 

•  Concise  and  timely  communication  of  problems  using 
redundant  paths 

•  Insistence  on  airing  minority  opinions 

•  Formal  written  reports  based  on  independent  peer-re- 
viewed recommendations  from  prime  contractors 

•  Facing  facts  objectively  and  with  attention  to  detail 

•  Ability  to  manage  change  and  deal  with  obsolescence  of 
classes  of  warships  over  their  lifetime 

These  elements  can  be  grouped  into  several  thematic  cat- 
egories: 

•  Communication  and  Action:  Formal  and  informal 
practices  ensure  that  relevant  personnel  at  all  levels  are 
informed  of  technical  decisions  and  actions  that  affect 
their  area  of  responsibility.  Contractor  technical  recom- 
mendations and  government  actions  are  documented  in 
peer-reviewed  formal  written  correspondence.  Unlike 
NASA,  PowerPoint  briefings  and  papers  for  technical 
seminars  are  not  substitutes  for  completed  staff  work.  In 
addition,  contractors  strive  to  provide  recommendations 
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based  on  a  technical  need,  uninfluenced  by  headquarters 
or  its  representatives.  Accordingly,  division  of  respon- 
sibilities between  the  contractor  and  the  Government 
remain  clear,  and  a  system  of  checks  and  balances  is 
therefore  inherent. 

•  Recurring  Training  and  Learning  From  Mistakes: 

The  Naval  Reactor  Program  has  yet  to  experience  a 
reactor  accident.  This  success  is  partially  a  testament 
to  design,  but  also  due  to  relentless  and  innovative 
training,  grounded  on  lessons  learned  both  inside  and 
outside  the  program.  For  example,  since  1996.  Naval 
Reactors  has  educated  more  than  5,000  Naval  Nuclear 
Propulsion  Program  personnel  on  the  lessons  learned 
from  the  Challenger  accident.-'  Senior  NASA  man- 
agers recently  attended  the  143rd  presentation  of  the 
Naval  Reactors  seminar  entitled  "The  Challenger  Ac- 
cident Re-examined."  The  Board  credits  NASA's  inter- 
est in  the  Navy  nuclear  community,  and  encourages  the 
agency  to  continue  to  learn  from  the  mistakes  of  other 
organizations  as  well  as  from  its  own. 

•  Encouraging  Minority  Opinions:  The  Naval  Reactor 
Program  encourages  minority  opinions  and  "bad  news." 
Leaders  continually  emphasize  that  when  no  minority 
opinions  are  present,  the  responsibility  for  a  thorough 
and  critical  examination  falls  to  management.  Alternate 
perspectives  and  critical  questions  are  always  encour- 
aged. In  practice,  NASA  does  not  appear  to  embrace 
these  attitudes.  Board  interviews  revealed  that  it  is  diffi- 
cult for  minority  and  dissenting  opinions  to  percolate  up 
through  the  agency's  hierarchy,  despite  processes  like 
the  anonymous  NASA  Safety  Reporting  System  that 
supposedly  encourages  the  airing  of  opinions. 

•  Retaining  Knowledge:  Naval  Reactors  uses  many 
mechanisms  to  ensure  knowledge  is  retained.  The  Di- 
rector serves  a  minimum  eight-year  term,  and  the  pro- 
gram documents  the  history  of  the  rationale  for  every 
technical  requirement.  Key  personnel  in  Headquarters 
routinely  rotate  into  field  positions  to  remain  familiar 
with  every  aspect  of  operations,  training,  maintenance, 
development  and  the  workforce.  Current  and  past  is- 
sues are  discussed  in  open  forum  with  the  Director  and 
immediate  staff  at  "all-hands"  informational  meetings 
under  an  in-house  professional  development  program. 
NASA  lacks  such  a  program. 

•  Worst-Case  Event  Failures:  Naval  Reactors  hazard 
analyses  evaluate  potential  damage  to  the  reactor  plant, 
potential  impact  on  people,  and  potential  environmental 
impact.  The  Board  identified  NASA's  failure  to  ad- 
equately prepare  for  a  range  of  worst-case  scenarios  as 
a  weakness  in  the  agency's  safety  and  mission  assurance 
training  programs. 

SUBSAFE 

The  Board  observed  the  following  during  its  study  of  the 
Navy's  SUBSAFE  Program. 


•  SUBSAFE  requirements  are  clearly  documented  and 
achievable,  with  minimal  "tailoring"  or  granting  of 
waivers.  NASA  requirements  are  clearly  documented 
but  are  also  more  easily  waived. 

•  A  separate  compliance  verification  organization  inde- 
pendently assesses  program  management.-''  NASA's 
Flight  Preparation  Process,  which  leads  to  Certification 
of  Flight  Readiness,  is  supposed  to  be  an  independent 
check-and-balance  process.  However,  the  Shuttle 
Program's  control  of  both  engineering  and  safety  com- 
promises the  independence  of  the  Flight  Preparation 
Process. 

•  The  submarine  Navy  has  a  strong  safety  culture  that  em- 
phasizes understanding  and  learning  from  past  failures. 
NASA  emphasizes  safety  as  well,  but  training  programs 
are  not  robust  and  methods  of  learning  from  past  fail- 
ures are  informal. 

•  The  Navy  implements  extensive  safety  training  based 
on  the  Thresher  and  Scorpion  accidents.  NASA  has  not 
focused  on  any  of  its  past  accidents  as  a  means  of  men- 
toring new  engineers  or  those  destined  for  management 
positions. 

•  The  SUBSAFE  structure  is  enhanced  by  the  clarity, 
uniformity,  and  consistency  of  submarine  safety  re- 
quirements and  responsibilities.  Program  managers  are 
not  permitted  to  "tailor"  requirements  without  approval 
from  the  organization  with  final  authority  for  technical 
requirements  and  the  organization  that  verifies  SUB- 
SAFE's  compliance  with  critical  design  and  process 
requirements.-"^ 

•  The  SUBSAFE  Program  and  implementing  organiza- 
tion are  relatively  immune  to  budget  pressures.  NASA's 
program  structure  requires  the  Program  Manager  posi- 
tion to  consider  such  issues,  which  forces  the  manager 
to  juggle  cost,  schedule,  and  safety  considerations.  In- 
dependent advice  on  these  issues  is  therefore  inevitably 
subject  to  political  and  administrative  pressure. 

•  Compliance  with  critical  SUBSAFE  design  and  pro- 
cess requirements  is  independently  verified  by  a  highly 
capable  centralized  organization  that  also  "owns"  the 
processes  and  monitors  the  program  for  compliance. 

•  Quantitative  safety  assessments  in  the  Navy  submarine 
program  are  deterministic  rather  than  probabilistic. 
NASA  does  not  have  a  quantitative,  program-wide  risk 
and  safety  database  to  support  future  design  capabilities 
and  assist  risk  assessment  teams. 

Comparing  Navy  Programs  with  NASA 

Significant  differences  exist  between  NASA  and  Navy  sub- 
marine programs. 

•  Requirements   Ownership    (Technical    Authority): 

Both  the  SUBSAFE  and  Naval  Reactors'  organizational 
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approach  separates  the  technical  and  funding  authority 
from  program  management  in  safety  matters.  The  Board 
believes  this  separation  of  authority  of  program  man- 
agers -  who,  by  nature,  must  be  sensitive  to  costs  and 
schedules  -  and  "owners"  of  technical  requirements  and 
waiver  capabilities  -  who,  by  nature,  are  more  sensitive 
to  safety  and  technical  rigor  -  is  crucial.  In  the  Naval 
Reactors  Program,  safety  matters  are  the  responsibility 
of  the  technical  authority.  They  are  not  merely  relegated 
to  an  independent  safety  organization  with  oversight 
responsibilities.  This  creates  valuable  checks  and  bal- 
ances for  safety  matters  in  the  Naval  Reactors  Program 
technical  "requirements  owner"  community. 

•  Emphasis  on  Lessons  Learned:  Both  Naval  Reac- 
tors and  the  SUBSAFE  have  "institutionalized"  their 
"lessons  learned"  approaches  to  ensure  that  knowl- 
edge gained  from  both  good  and  bad  experience 
is  maintained  in  corporate  memory.  This  has  been 
accomplished  by  designating  a  central  technical  au- 
thority responsible  for  establishing  and  maintaining 
functional  technical  requirements  as  well  as  providing 
an  organizational  and  institutional  focus  for  capturing, 
documenting,  and  using  operational  lessons  to  improve 
future  designs.  NASA  has  an  impressive  history  of 
scientific  discovery,  but  can  learn  much  from  the  ap- 
plication of  lessons  learned,  especially  those  that  relate 
to  future  vehicle  design  and  training  for  contingen- 
cies. NASA  has  a  broad  Lessons  Learned  Information 
System  that  is  strictly  voluntary  for  program/project 
managers  and  management  teams.  Ideally,  the  Lessons 
Learned  Information  System  should  support  overall 
program  management  and  engineering  functions  and 
provide  a  historical  experience  base  to  aid  conceptual 
developments  and  preliminary  design. 

The  Aerospace  Corporation 

The  Aerospace  Corporation,  created  in  1960,  operates  as  a 
Federally  Funded  Research  and  Development  Center  that 
supports  the  government  in  science  and  technology  that  is 
critical  to  national  security.  It  is  the  equivalent  of  a  $500 
million  enterprise  that  supports  U.S.  Air  Force  planning, 
development,  and  acquisition  of  space  launch  systems. 
The  Aerospace  Cor{:)oration  employs  approximately  3,200 
people  including  2,200  technical  staff  (29  percent  Doctors 
of  Philosophy,  41  percent  Masters  of  Science)  who  conduct 
advanced  planning,  system  design  and  integration,  verify 
readiness,  and  provide  technical  oversight  of  contractors.''' 

The  Aerospace  Corporation's  independent  launch  verifica- 
tion process  offers  another  relevant  benchmark  for  NASA's 
safety  and  mission  assurance  program.  Several  aspects  of 
the  Aerospace  Corporation  launch  verification  process  and 
independent  mission  assurance  structure  could  be  tailored  to 
the  Shuttle  Program. 

Aerospace's  primary  product  is  a  formal  verification  letter 
to  the  Air  Force  Systems  Program  Office  stating  a  vehicle 
has  been  independently  verified  as  ready  for  launch.  The 
verification  includes  an  independent  General  Systems  En- 
gineering and  Integration  review  of  launch  preparations  by 


Aerospace  staff,  a  review  of  launch  system  design  and  pay- 
load  integration,  and  a  review  of  the  adequacy  of  flight  and 
ground  hardware,  software,  and  interfaces.  This  "concept- 
to-orbit"  process  begins  in  the  design  requirements  phase, 
continues  through  the  formal  verification  to  countdown 
and  launch,  and  concludes  with  a  post-flight  evaluation  of 
events  with  findings  for  subsequent  missions.  Aerospace 
Corporation  personnel  cover  the  depth  and  breadth  of  space 
disciplines,  and  the  organization  has  its  own  integrated  en- 
gineering analysis,  laboratory,  and  test  matrix  capability. 
This  enables  the  Aerospace  Corporation  to  rapidly  transfer 
lessons  learned  and  respond  to  program  anomalies.  Most 
importantly.  Aerospace  is  uniquely  independent  and  is  not 
subject  to  any  schedule  or  cost  pressures. 

The  Aerospace  Corporation  and  the  Air  Force  have  found 
the  independent  launch  verification  process  extremely 
valuable.  Aerospace  Corporation  involvement  in  Air  Force 
launch  verification  has  significantly  reduced  engineering  er- 
rors, resulting  in  a  2.9  percent  "probability-of-failure"  rate 
for  expendable  launch  vehicles,  compared  to  14.6  percent  in 
the  commercial  sector." 

Conclusion 

The  practices  noted  here  suggest  that  responsibility  and  au- 
thority for  decisions  involving  technical  requirements  and 
safety  should  rest  with  an  independent  technical  authority. 
Organizations  that  successfully  operate  high-risk  technolo- 
gies have  a  major  characteristic  in  common:  they  place  a 
premium  on  safety  and  reliability  by  structuring  their  pro- 
grams so  that  technical  and  safety  engineering  organizations 
own  the  process  of  determining,  maintaining,  and  waiving 
technical  requirements  with  a  voice  that  is  equal  to  yet  in- 
dependent of  Program  Managers,  who  are  governed  by  cost, 
schedule  and  mission-accomplishment  goals.  The  Naval 
Reactors  Program,  SUBSAFE  program,  and  the  Aerospace 
Corporation  are  examples  of  organizations  that  have  in- 
vested in  redundant  technical  authorities  and  processes  to 
become  highly  reliable. 

7.4    Organizational  Causes: 
A  Broken  Safety  Culture 

Perhaps  the  most  perplexing  question  the  Board  faced 
during  its  seven-month  investigation  into  the  Coliiinhia 
accident  was  "How  could  NASA  have  missed  the  signals 
the  foam  was  sending?"  Answering  this  question  was  a 
challenge.  The  investigation  revealed  that  in  most  cases, 
the  Human  Space  Flight  Program  is  extremely  aggressive  in 
reducing  threats  to  safety.  But  we  also  know  -  in  hindsight 
-  that  detection  of  the  dangers  posed  by  foam  was  impeded 
by  "blind  spots"  in  NASA's  safety  culture. 

From  the  beginning,  the  Board  witnessed  a  consistent  lack 
of  concern  nboul  the  debris  strike  on  Coliinihia.  NASA  man- 
agers told  the  Board  "there  was  no  safety-of-flight  issue" 
and  "we  couldn't  have  done  anything  about  it  anyway."  The 
investigation  uncovered  a  troubling  pattern  in  which  Shuttle 
Program  management  made  erroneous  assumptions  about 
the  robustness  of  a  system  based  on  prior  success  rather  than 
on  dependable  engineering  data  and  rigorous  testing. 
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The  Shuttle  Program's  complex  structure  erected  barriers 
to  effective  communication  and  its  safety  culture  no  longer 
asks  enough  hard  questions  about  risk.  (Safety  culture  refers 
to  an  organization's  characteristics  and  attitudes  -  promoted 
by  its  leaders  and  internalized  by  its  members  -  that  serve 
to  make  safety  the  top  priority.)  In  this  context,  the  Board 
believes  the  mistakes  that  were  made  on  STS-107  are  not 
isolated  failures,  but  are  indicative  of  systemic  flaws  that 
existed  prior  to  the  accident.  Had  the  Shuttle  Program  ob- 
served the  principles  discussed  in  the  previous  two  sections, 
the  threat  that  foam  posed  to  the  Orbiter,  particularly  after 
the  STS-112  and  STS-107  foam  strikes,  might  have  been 
more  fully  appreciated  by  Shuttle  Program  management. 

In  this  section,  the  Board  examines  the  NASA's  safety 
policy,  structure,  and  process,  communication  barriers,  the 
risk  assessment  systems  that  govern  decision-making  and 
risk  management,  and  the  Shuttle  Program's  penchant  for 
substituting  analysis  for  testing. 

NASA's  Safety:  Policy,  Structure,  and  Process 


quarters  and  decentralized  execution  of  safety  programs  at 
the  enterprise,  program,  and  project  levels.  Headquarters 
dictates  what  must  be  done,  not  how  it  should  be  done.  The 
operational  premise  that  logically  follows  is  that  safety  is  the 
responsibility  of  program  and  project  managers.  Managers 
are  subsequently  given  flexibility  to  organize  safety  efforts 
as  they  see  fit,  while  NASA  Headquarters  is  charged  with 
maintaining  oversight  through  independent  surveillance  and 
assessment.-'*  NASA  policy  dictates  that  .safety  programs 
should  be  placed  high  enough  in  the  organization,  and  be 
vested  with  enough  authority  and  seniority,  to  "maintain 
independence."  Signals  of  potential  danger,  anomalies, 
and  critical  infomiation  should,  in  principle,  surface  in  the 
hazard  identification  process  and  be  tracked  with  risk  assess- 
ments supported  by  engineering  analyses.  In  reality,  such  a 
process  demands  a  more  independent  status  than  NASA  has 
ever  been  willing  to  give  its  safety  organizations,  despite  the 
recommendations  of  numerous  outside  experts  over  nearly 
two  decades,  including  the  Rogers  Commi.ssion  (1986), 
General  Accounting  Office  ( 1990),  and  the  Shuttle  Indepen- 
dent Assessment  Team  (2000). 


Safety  Policy 


Safety  Organization  Structure 


NASA's  current  philosophy  for  safety  and  mission  assur- 
ance calls  for  centralized  policy  and  oversight  at  Head- 


Center  safety  organizations  that  support  the  Shuttle  Pro- 
gram are  tailored  to  the  missions  they  perfonn.  Johnson  and 
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Marshall  Safety  and  Mission  Assurance  organizations  are 
organized  similarly.  In  contrast,  Kennedy  has  decentralized 
its  Safety  and  Mission  Assurance  components  and  assigned 
them  to  the  Shuttle  Processing  Directorate.  This  manage- 
ment change  renders  Kennedy's  Safety  and  Mission  Assur- 
ance structure  even  more  dependent  on  the  Shuttle  Program, 
which  reduces  effective  oversight. 

At  Johnson,  safety  programs  are  centralized  under  a  Direc- 
tor who  oversees  five  divisions  and  an  Independent  Assess- 
ment Office.  Each  division  has  clearly-defined  roles  and 
responsibilities,  with  the  exception  of  the  Space  Shuttle 
Division  Chief,  whose  job  description  does  not  reflect  the 
full  scope  of  authority  and  responsibility  ostensibly  vested 
in  the  position.  Yet  the  Space  Shuttle  Division  Chief  is  em- 
powered to  represent  the  Center,  the  Shuttle  Program,  and 
NASA  Headquarters  Safety  and  Mission  Assurance  at  criti- 
cal junctures  in  the  safety  process.  The  position  therefore 
represents  a  critical  node  in  NASA's  Safety  and  Mission  As- 
surance architecture  that  seems  to  the  Board  to  be  plagued 
by  conflict  of  interest.  It  is  a  single  point  of  failure  without 
any  checks  or  balances. 

Johnson,  also  has  a  Shuttle  Program  Safety  and  Mission 
Assurance  Manager  who  oversees  United  Space  Alliance's 
safety  organization.  The  Shuttle  Program  further  receives 
program  safety  support  from  the  Center's  Safety.  Reliability, 
and  Quality  Assurance  Space  Shuttle  Division.  Johnson's 
Space  Shuttle  Division  Chief  has  the  additional  role  of 
Shuttle  Program  Safety,  Reliability,  and  Quality  Assurance 
Manager  (see  Figure  7.4-1).  Over  the  years,  this  dual  desig- 
nation has  resulted  in  a  general  acceptance  of  the  fact  that 
the  Johnson  Space  Shuttle  Division  Chief  performs  duties 
on  both  the  Center's  and  Program's  behalf.  The  detached 
nature  of  the  support  provided  by  the  Space  Shuttle  Division 
Chief,  and  the  wide  band  of  the  position's  responsibilities 
throughout  multiple  layers  of  NASA's  hierarchy,  confuses 
lines'  of  authority,  responsibility,  and  accountability  in  a 
manner  that  almost  defies  explanation. 

A  March  2001  NASA  Office  of  Inspector  General  Audit 
Report  on  Space  Shuttle  Program  Management  Safety  Ob- 
servations made  the  same  point; 

The  job  descriptions  and  responsibilities  of  the  Space 
Shuttle  Program  Manager  and  Chief,  Johnson  Safety 
Office  Space  Shuttle  Division,  are  nearly  identical  with 
each  official  reporting  to  a  different  manager.  This  over- 
lap in  responsibilities  conflicts  with  the  SFOC  [Space 
Flight  Operations  Contract]  and  NSTS  07700,  which 
requires  the  Chief,  Johnson  Safety  Office  Space  Shuttle 
Division,  to  provide  matrixed  personnel  support  to  the 
Space  Shuttle  Program  Safety  Manager  in  fulfilling  re- 
quirements applicable  to  the  safety,  reliability,  and  qual- 
ity assurance  aspects  of  the  Space  Shuttle  Program. 

The  fact  that  Headquarters,  Center,  and  Program  functions 
are  rolled-up  into  one  position  is  an  example  of  how  a  care- 
fully designed  oversight  process  has  been  circumvented  and 
made  susceptible  to  conflicts  of  interest.  This  organizational 
construct  is  unnecessarily  bureaucratic  and  defeats  NASA's 
stated  objective  of  providing  an  independent  safety  func- 


tion. A  similar  argument  can  be  made  about  the  placement 
of  quality  assurance  in  the  Shuttle  Processing  Divisions  at 
Kennedy,  which  increases  the  risk  that  quality  assurance 
personnel  will  become  too  "familiar"  with  programs  they  are 
charged  to  oversee,  which  hinders  oversight  and  judgment. 

The  Board  believes  that  although  the  Space  Shuttle  Program 
has  effective  safety  practices  at  the  "shop  floor"  level,  its 
operational  and  systems  safety  program  is  flawed  by  its 
dependence  on  the  Shuttle  Program.  Hindered  by  a  cumber- 
some organizational  structure,  chronic  understaffing,  and 
poor  management  principles,  the  safety  apparatus  is  not 
currently  capable  of  fulfilling  its  mission.  An  independent 
safety  structure  would  provide  the  Shuttle  Program  a  more 
effective  operational  safety  process.  Crucial  components  of 
this  structure  include  a  comprehensive  integration  of  safety 
across  all  the  Shuttle  programs  and  elements,  and  a  more 
independent  system  of  checks  and  balances. 

Safety  Process 

In  response  to  the  Rogers  Commission  Report,  NASA  es- 
tablished what  is  now  known  as  the  Office  of  Safety  and 
Mission  Assurance  at  Headquarters  to  independently  moni- 
tor safety  and  ensure  communication  and  accountability 
agency-wide.  The  Office  of  Safety  and  Mission  Assurance 
monitors  unusual  events  like  "out  of  family"  anomalies 
and  establishes  agency-wide  Safety  and  Mission  Assurance 
policy.  (An  out-of-family  event  is  an  operation  or  perfor- 
mance outside  the  expected  performance  range  for  a  given 
parameter  or  which  has  not  previously  been  experienced.) 
The  Office  of  Safety  and  Mission  Assurance  also  screens  the 
Shuttle  Program's  Flight  Readiness  Process  and  signs  the 
Certificate  of  Flight  Readiness.  The  Shuttle  Program  Man- 
ager, in  turn,  is  responsible  for  overall  Shuttle  safety  and  is 
supported  by  a  one-person  safety  staff. 

The  Shuttle  Program  has  been  permitted  to  organize  its 
safety  program  as  it  sees  fit,  which  has  resulted  in  a  lack  of 
standardized  structure  throughout  NASA's  various  Centers, 
enterprises,  programs,  and  projects.  The  level  of  funding  a 
program  is  granted  impacts  how  much  safety  the  Program 
can  "buy"  from  a  Center's  safety  organization.  In  turn.  Safe- 
ty and  Mission  Assurance  organizations  struggle  to  antici- 
pate program  requirements  and  guarantee  adequate  support 
for  the  many  programs  for  which  they  are  responsible. 

It  is  the  Board's  view,  shared  by  previous  assessments, 
that  the  current  safety  system  structure  leaves  the  Office  of 
Safety  and  Mission  Assurance  ill-equipped  to  hold  a  strong 
and  central  role  in  integrating  safety  functions.  NASA  Head- 
quarters has  not  effectively  integrated  safety  efforts  across 
its  culturally  and  technically  distinct  Centers.  In  addition, 
the  practice  of  "buying"  safety  services  establishes  a  rela- 
tionship in  which  programs  sustain  the  very  livelihoods  of 
the  safety  experts  hired  to  oversee  them.  These  idiosyncra- 
sies of  structure  and  funding  preclude  the  safety  organiza- 
tion from  effectively  providing  independent  safety  analysis. 

The  commit-to-flight  review  process,  as  described  in  Chap- 
ters 2  and  6.  consists  of  program  reviews  and  readiness  polls 
that  are  structured  to  allow  NASA's  senior  leaders  to  assess 
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mission  readiness.  In  lii<e  fashion,  safety  organizations  affil- 
iated with  various  projects,  programs,  and  Centers  at  NASA, 
conduct  a  Pre-iaunch  Assessment  Review  of  safety  prepara- 
tions and  mission  concerns.  The  Shuttle  Program  does  not 
officially  sanction  the  Pre-iaunch  Assessment  Review,  which 
updates  the  Associate  Administrator  for  Safety  and  Mission 
Assurance  on  safety  concerns  during  the  Flight  Readiness 
Review/Certification  of  Flight  Readiness  process. 

The  Johnson  Space  Shuttle  Safety.  Reliability,  and  Quality 
Assurance  Division  Chief  orchestrates  this  review  on  behalf 
of  Headquarters.  Note  that  this  division  chief  also  advises 
the  Shuttle  Program  Manager  of  Safety.  Because  it  lacks 
independent  analytical  rigor,  the  Pre-iaunch  Assessment  Re- 
view is  only  marginally  effective,  in  this  an^angement.  the 
Johnson  Shuttle  Safety.  Reliability,  and  Quality  Assurance 
Division  Chief  is  expected  to  render  an  independent  assess- 
mentofhis  own  activities.  Therefore,  the  Board  is  concerned 
that  the  Pre-Launch  Assessment  Review  is  not  an  effective 
check  and  balance  in  the  Flight  Readiness  Review. 

Given  that  the  entire  Safety  and  Mission  Assurance  orga- 
nization depends  on  the  Shuttle  Program  for  resources  and 
simultaneously  lacks  the  independent  ability  to  conduct 
detailed  analyses,  cost  and  schedule  pressures  can  easily 
and  unintentionally  influence  safety  deliberations.  Structure 
and  process  places  Shuttle  safety  programs  in  the  unenvi- 
able position  of  having  to  choose  between  rubber-stamping 
engineering  analyses,  technical  efforts,  and  Shuttle  program 
decisions,  or  tr>'ing  to  carry  the  day  during  a  committee 
meeting  in  which  the  other  side  almost  always  has  more 
information  and  analytic  capability. 

NASA  Barriers  to  Communication:  Integration, 
Information  Systems,  and  Databases 

By  their  very  nature,  high-risk  technologies  are  exception- 
ally difficult  to  manage.  Complex  and  intricate,  they  consist 
of  numerous  interrelated  parts.  Standing  alone,  components 
may  function  adequately,  and  failure  modes  may  be  an- 
ticipated. Yet  when  components  are  integrated  into  a  total 
system  and  work  in  concert,  unanticipated  interactions  can 
occur  that  can  lead  to  catastrophic  outcomes.-''  The  risks 
inherent  in  these  technical  systems  are  heightened  when 
they  are  produced  and  operated  by  complex  organizations 
that  can  also  break  down  in  unanticipated  ways.  The  Shuttle 
Program  is  such  an  organization.  All  of  these  factors  make 
effective  communication  -  between  individuals  and  between 
programs  -  absolutely  critical.  However,  the  structure  and 
complexity  of  the  Shuttle  Program  hinders  communication. 

The  Shuttle  Program  consists  of  government  and  contract 
personnel  who  cover  an  array  of  scientific  and  technical 
disciplines  and  are  affiliated  with  various  dispersed  space, 
research,  and  test  centers.  NASA  derives  its  organizational 
complexity  from  its  origins  as  much  as  its  widely  varied 
missions.  NASA  Centers  naturally  evolved  with  different 
points  of  focus,  a  "divergence"  that  the  Rogers  Commission 
found  evident  in  the  propensity  of  Marshall  personnel  to 
resolve  problems  without  including  program  managers  out- 
side their  Center  -  especially  managers  at  Johnson,  to  whom 
they  officially  reported  (see  Chapter  5). 


Despite  periodic  attempts  to  emphasize  safety,  NASA's  fre- 
quent reorganizations  in  the  drive  to  become  more  efficient 
reduced  the  budget  for  safety,  sending  employees  conflict- 
ing messages  and  creating  conditions  more  conducive  to 
the  development  of  a  conventional  bureaucracy  than  to  the 
maintenance  of  a  safety-conscious  research-and-develop- 
ment  organization.  Over  time,  a  pattern  of  ineffective  com- 
munication has  resulted,  leaving  risks  improperly  defined, 
problems  unreported,  and  concerns  unexpressed.'"  The 
question  is,  why? 

The  transition  to  the  Space  Flight  Operations  Contract  -  and 
the  effects  it  initiated  -  provides  part  of  the  answer  In  the 
Space  Flight  Operations  Contract,  NASA  encountered  a 
completely  new  set  of  structural  constraints  that  hindered  ef- 
fective communication.  New  organizational  and  contractual 
requirements  demanded  an  even  more  complex  system  of 
shared  management  reviews,  reporting  relationships,  safety 
oversight  and  insight,  and  program  information  develop- 
ment, dissemination,  and  tracking. 

The  Shuttle  Independent  Assessment  Team's  report  docu- 
mented these  changes,  noting  that  "the  size  and  complexity 
of  the  Shuttle  system  and  of  the  NASA/contractor  relation- 
ships place  extreme  importance  on  understanding,  commu- 
nication, and  information  handling.""  Among  other  findings, 
the  Shuttle  Independent  Assessment  Team  observed  that: 

•  The  current  Shuttle  program  culture  is  too  insular 

•  There  is  a  potential  for  conflicts  between  contractual 
and  programmatic  goals 

•  There  are  deficiencies  in  problem  and  waiver-tracking 
systems 

•  The  exchange  of  communication  across  the  Shuttle  pro- 
gram hierarchy  is  structurally  limited,  both  upward  and 
downward. '- 

The  Board  believes  that  deficiencies  in  communication,  in- 
cluding those  spelled  out  by  the  Shuttle  Independent  Assess- 
ment Team,  were  a  foundation  for  the  Columbia  accident. 
These  deficiencies  are  byproducts  of  a  cumbersome,  bureau- 
cratic, and  highly  complex  Shuttle  Program  structure  and 
the  absence  of  authority  in  two  key  program  areas  that  are 
responsible  for  integrating  information  across  all  programs 
and  elements  in  the  Shuttle  program. 

Integration  Structures 

NASA  did  not  adequately  prepare  for  the  consequences  of 
adding  organizational  structure  and  process  complexity  in 
the  transition  to  the  Space  Flight  Operations  Contract.  The 
agency's  lack  of  a  centralized  clearinghouse  for  integration 
and  safety  further  hindered  safe  operations.  In  the  Board's 
opinion,  the  Shuttle  Integration  and  Shuttle  Safety.  Reli- 
ability, and  Quality  Assurance  Offices  do  not  fully  integrate 
information  on  behalf  of  the  Shuttle  Program.  This  is  due,  in 
pail,  to  an  irregular  division  of  responsibilities  between  the 
Integration  Office  and  the  Orbiter  Vehicle  Enginecing  Office 
and  the  absence  of  a  truly  independent  safety  organization. 

Within  the  Shuttle  Program,  the  Orbiter  Office  handles  many 
key  integration  tasks,  even  though  the  Integration  Office  ap- 
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pears  to  be  the  more  logical  office  to  conduct  them;  the  Or- 
biter  Office  does  not  actively  participate  in  the  Integration 
Control  Board;  and  Orbiter  Office  managers  are  actually 
ranked  above  their  Integration  Office  counterparts.  These 
uncoordinated  roles  result  in  conflicting  and  erroneous 
information,  and  support  the  perception  that  the  Orbiter  Of- 
fice is  isolated  from  the  Integration  Office  and  has  its  own 
priorities. 

The  Shuttle  Program's  structure  and  process  for  Safety  and 
Mission  Assurance  activities  further  confuse  authority  and 
responsibility  by  giving  the  Program's  Safety  and  Mis- 
sion Assurance  Manager  technical  oversight  of  the  safety 
aspects  of  the  Space  Flight  Operations  Contract,  while 
simultaneously  making  the  Johnson  Space  Shuttle  Division 
Chief  responsible  for  advising  the  Program  on  safety  per- 
formance. As  a  result,  no  one  office  or  person  in  Program 
management  is  responsible  for  developing  an  integrated 
risk  assessment  above  the  sub-system  level  that  would  pro- 
vide a  comprehensive  picture  of  total  program  risks.  The 
net  effect  is  that  many  Shuttle  Program  safety,  quality,  and 
mission  assurance  roles  are  never  clearly  defined. 

Safety  Information  Systems 

Numerous  reviews  and  independent  assessments  have 
noted  that  NASA's  safety  system  does  not  effectively  man- 
age risk.  In  particular,  these  reviews  have  observed  that  the 
processes  in  which  NASA  tracks  and  attempts  to  mitigate 
the  risks  po.sed  by  components  on  its  Critical  Items  List  is 
flawed.  The  Post  Challenger  Evaluation  of  Space  Shuttle 
Risk  Assessment  and  Management  Report  (1988)  con- 
cluded that: 

The  committee  views  NASA  critical  items  list  (CIL) 
waiver  decision-making  process  as  being  siihjective, 
with  little  in  the  way  of  formal  and  consistent  criteria 
for  approval  or  rejection  of  waivers.  Waiver  decisions 
appear  to  he  driven  almost  e.\:clusively  hy  the  design 
based  Failure  Mode  Effects  Analysis  (FMEAj/CIL 
retention  rationale,  rather  than  being  based  on  an  in- 
tegrated assessment  of  all  inputs  to  risk  management. 
The  retention  rationales  appear  biased  toward  proving 
that  the  design  is  "safe, "  sometimes  ignoring  signifi- 
cant evidence  to  the  contrary'. 

The  report  continues,  "...  the  Committee  has  not  found  an 
independent,  detailed  analysis  or  assessment  of  the  CIL 
retention  rationale  which  considers  all  inputs  to  the  risk  as- 
sessment process."*'  Ten  years  later,  the  Shuttle  Independent 
Assessment  Team  reported  "Risk  Management  process  ero- 
sion created  by  the  desire  to  reduce  costs  ..."  '■* The  Shuttle 
Independent  Assessment  Team  argued  strongly  that  NASA 
Safety  and  Mission  Assurance  should  be  restored  to  its  pre- 
vious role  of  an  independent  oversight  body,  and  Safety  and 
Mission  Assurance  not  be  simply  a  "safety  auditor." 

The  Board  found  similar  problems  with  integrated  hazard 
analyses  of  debris  strikes  on  the  Orbiter.  In  addition,  the 
information  systems  supporting  the  Shuttle  -  intended  to  be 
tools  for  decision-making  -  are  extremely  cumbersome  and 
difficult  to  use  at  anv  level. 


The  following  addresses  the  hazard  tracking  tools  and  major 
databases  in  the  Shuttle  Program  that  promote  risk  manage- 
ment. 

•  Hazard  Analysis:  A  fundamental  element  of  system 
safety  is  managing  and  controlling  hazards.  NASA's 
only  guidance  on  hazard  analysis  is  outlined  in  the 
Methodology  for  Conduct  of  Space  Shuttle  Program 
Hazard  Analysis,  which  merely  lists  tcxils  available.'' 
Therefore,  it  is  not  suiprising  that  hazard  analysis  pro- 
cesses are  applied  inconsistently  across  systems,  sub- 
systems, assemblies,  and  components. 

United  Space  Alliance,  which  is  responsible  for  both 
Orbiter  integration  and  Shuttle  Safety  Reliability  and 
Quality  Assurance,  delegates  hazard  analysis  to  Boe- 
ing. However,  as  of  2001,  the  Shuttle  Program  no 
longer  requires  Boeing  to  conduct  integrated  hazard 
analyses.  Instead,  Boeing  now  performs  hazard  analysis 
only  at  the  sub-system  level.  In  other  words,  Boeing 
analyzes  hazards  to  components  and  elements,  but  is 
not  required  to  consider  the  Shuttle  as  a  whole.  Since 
the  current  Failure  Mode  Effects  Analysis/Critical  Item 
List  process  is  designed  for  bottom-up  analysis  at  the 
component  level,  it  cannot  effectively  support  the  kind 
of  "top-down"  hazard  analysis  that  is  needed  to  inform 
managers  on  nsk  trends  and  identify  potentially  harmful 
interactions  between  systems. 

The  Critical  Item  List  (CIL)  tracks  5.396  individual 
Shuttle  hazards,  of  which  4,222  are  termed  "Critical- 


Space  Shuhle  Safety  Upgrade 
Program 

NASA  presented  a  Space  Shuttle  Safety  Upgrade  Initiative 
to  Congress  as  part  of  its  Fiscal  Year  2001  budget  in  March 
2000.  This  initiative  sought  to  create  a  "Pro-active  upgrade 
program  to  keep  ShuUle  flying  safely  and  efficiently  to  2012 
and  beyond  to  meet  agency  commitments  and  goals  for  hu- 
man access  to  space." 

The  planned  Shuttle  safety  upgrades  included:  Electric 
Auxiliary  Power  Unit,  Improved  Main  Landing  Gear  Tire, 
Orbiter  Cockpit/ Avionics  Upgrades,  Space  Shuttle  Main  En- 
gine Advanced  Health  Management  System,  Block  HI  Space 
Shuttle  Main  Engine,  Solid  Rocket  Booster  Thrust  Vector 
Control/Auxiliary  Power  Unit  Upgrades  Plan,  Redesigned 
Solid  Rocket  Motor  -  Propellant  Grain  Geometry  Modifica- 
tion, and  External  Tank  Upgrades  -  Friction  Stir  Weld.  The 
plan  called  tor  the  upgrades  to  be  completed  by  2008. 

However,  as  discussed  in  Chapter  5,  every  proposed  safety 
upgrade  -  with  a  few  exceptions  -  was  either  not  approved 
or  was  defeired. 

The  irony  of  the  Space  Shutde  Safety  Upgrade  Program  was 
that  the  strategy  placed  emphasis  on  keeping  the  "Shuttle 
flying  safely  and  efficiendy  to  2012  and  beyond."  yet  the 
Space  Flight  Leadership  Council  accepted  the  upgrades 
only  as  long  as  they  were  financially  feasible.  Funding  a 
safely  upgrade  in  order  to  fly  safely,  and  then  canceling  it 
for  Inulgetary  reasons,  makes  the  concept  of  mission  safety 
rather  hollow. 
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ity  1/lR."  Of  those.  3,233  have  waivers.  CRIT  I/IR 
component  failures  are  defined  as  those  that  will  result 
in  loss  of  the  Orbiter  and  crew.  Waivers  are  granted 
whenever  a  Critical  Item  List  component  cannot  be 
redesigned  or  replaced.  More  than  36  percent  of  these 
waivers  have  not  been  reviewed  in  10  years,  a  sign  that 
NASA  is  not  aggressively  monitoring  changes  in  sys- 
tem risk. 

It  is  worth  noting  that  the  Shuttle's  Thermal  Protection 
System  is  on  the  Critical  Item  List,  and  an  existing  haz- 
ard analysis  and  hazard  report  deals  with  debris  strikes. 
As  discussed  in  Chapter  6,  Hazard  Report  #37  is  inef- 
fectual as  a  decision  aid,  yet  the  Shuttle  Program  never 
challenged  its  validity  at  the  pivotal  STS-113  Flight 
Readiness  Review. 

Although  the  Shuttle  Program  has  undoubtedly  learned 
a  great  deal  about  the  technological  limitations  inher- 
ent in  Shuttle  operations,  it  is  equally  clear  that  risk 
-  as  represented  by  the  number  of  critical  items  list 
and  waivers  -  has  grown  substantially  without  a  vigor- 
ous effort  to  assess  and  reduce  technical  problems  that 
increase  risk.  An  information  system  bulging  with  over 
5,000  critical  items  and  3,200  waivers  is  exceedingly 
difficult  to  manage. 

•  Hazard  Reports:  Hazard  reports,  written  either  by  the 
Space  Shuttle  Program  or  a  contractor,  document  con- 
ditions that  threaten  the  safe  operation  of  the  Shuttle. 
Managers  use  these  reports  to  evaluate  risk  and  justify 
flight.'''  During  mission  preparations,  contractors  and 
Centers  review  all  baseline  hazard  reports  to  ensure 
they  are  current  and  technically  correct. 

Board  investigators  found  that  a  large  number  of  hazard 
reports  contained  subjective  and  qualitative  judgments, 
such  as  "believed"  and  "based  on  experience  from 
previous  flights  this  hazard  is  an  'Accepted  Risk.""  A 
critical  ingredient  of  a  healthy  safety  program  is  the 
rigorous  implementation  of  technical  standards.  These 
standards  must  include  more  than  hazard  analysis  or 
low-level  technical  activities.  Standards  must  integrate 
project  engineering  and  management  activities.  Finally, 
a  mechanism  for  feedback  on  the  effectiveness  of  sys- 
tem safety  engineering  and  management  needs  to  be 
built  into  procedures  to  learn  if  safety  engineering  and 
management  methods  are  weakening  over  time. 

Dy.sfunctional  Databases 

In  its  investigation,  the  Board  found  that  the  information 
systems  that  support  the  Shuttle  program  are  extremely 
cumbersome  and  difficult  to  use  in  decision-making  at  any 
level.  For  obvious  reasons,  these  shortcomings  imperil  the 
Shuttle  Program's  ability  to  disseminate  and  share  critical 
information  among  its  many  layers.  This  section  explores 
the  report  databases  that  are  crucial  to  effective  risk  man- 
agement. 

•  Problem   Reporting   and   Corrective  Action:   The 

Problem   Reporting   and   Corrective   Action   database 


records  any  non-conformances  (instances  in  which  a 
requirement  is  not  met).  Formerly,  different  Centers  and 
contractors  used  the  Problem  Reporting  and  Corrective 
Action  database  differently,  which  prevented  compari- 
sons across  the  databa.se.  NASA  recently  initiated  an 
effort  to  integrate  these  databases  to  permit  anyone  in 
the  agency  to  access  information  from  different  Centers. 
This  system.  Web  Program  Compliance  Assurance  and 
Status  System  (WEBPCASS).  is  supposed  to  provide 
easier  access  to  consolidated  information  and  facilitates 
higher-level  searches. 

However,  NASA  safety  managers  have  complained  that 
the  system  is  too  time-consuming  and  cumbersome. 
Only  employees  trained  on  the  database  seem  capable 
of  using  WEBPCASS  effectively.  One  particularly 
frustrating  aspect  of  which  the  Board  is  acutely  aware  is 
the  database's  waiver  section.  It  is  a  critical  information 
source,  but  only  the  most  expert  users  can  employ  it  ef- 
fectively. The  database  is  also  incomplete.  For  instance, 
in  the  case  of  foam  strikes  on  the  Thermal  Protection 
System,  only  strikes  that  were  declared  "In-Fight 
Anomalies"  are  added  to  the  Problem  Reporting  and 
Cort'ective  Action  database,  which  masks  the  full  extent 
of  the  foam  debris  trends. 

•  Lessons  Learned  Information  System:  The  Lessons 
Learned  Information  System  database  is  a  much  simpler 
system  to  use,  and  it  can  assist  with  hazard  identification 
and  risk  assessment.  However,  personnel  familiar  with 
the  Lessons  Learned  Information  System  indicate  that 
design  engineers  and  mission  assurance  personnel  use  it 
only  on  an  ad  hoc  basis,  thereby  limiting  its  utility.  The 
Board  is  not  the  first  to  note  such  deficiencies.  Numer- 
ous reports,  including  most  recently  a  General  Account- 
ing Office  2001  report,  highlighted  fundamental  weak- 
nesses in  the  collection  and  sharing  of  lessons  learned 
by  program  and  project  managers.'' 

Conclusions 

Throughout  the  course  of  this  investigation,  the  Board  found 
that  the  Shuttle  Program's  complexity  demands  highly  ef- 
fective communication.  Yet  integrated  hazard  reports  and 
risk  analyses  are  rarely  communicated  effectively,  nor  are 
the  many  databases  used  by  Shuttle  Program  engineers  and 
managers  capable  of  translating  operational  experiences 
into  effective  risk  management  practices.  Although  the 
Space  Shuttle  system  has  conducted  a  relatively  small  num- 
ber of  missions,  there  is  more  than  enough  data  to  generate 
performance  trends.  As  it  is  currently  structured,  the  Shuttle 
Program  does  not  use  data-driven  safety  methodologies  to 
their  fullest  advantage. 

7.5    Organizational  Causes:  Impact  of 
A  Flawed  Safety  Culture  on  STS-107 

In  this  section,  the  Board  examines  how  and  why  an  array 
of  processes,  groups,  and  individuals  in  the  Shuttle  Program 
failed  to  appreciate  the  severity  and  implications  of  the 
foam  strike  on  STS-107.  The  Board  believes  that  the  Shuttle 
Program  should  have  been  able  to  detect  the  foam  trend  and 
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more  fully  appreciate  the  danger  it  represented.  Recall  that 
"safety  culture"  refers  to  the  collection  of  characteristics  and 
attitudes  in  an  organization  -  promoted  by  its  leaders  and  in- 
ternalized by  its  members  -  that  makes  safety  an  ovemding 
priority.  In  the  following  analysis,  the  Board  outlines  short- 
comings in  the  Space  Shuttle  Program,  Debris  Assessment 
Team,  and  Mission  Management  Team  that  resulted  from  a 
flawed  safety  culture. 

Shuttle  Program  Shortcomings 

The  flight  readiness  process,  which  involves  every  organi- 
zation affiliated  with  a  Shuttle  mission,  missed  the  danger 
signals  in  the  history  of  foam  loss. 

Generally,  the  higher  information  is  transmitted  in  a  hierar- 
chy, the  more  it  gets  "rolled-up,"  abbreviated,  and  simpli- 
fied. Sometimes  information  gets  lost  altogether,  as  weak 
signals  drop  from  memos,  problem  identification  systems, 
and  formal  presentations.  The  same  conclusions,  repeated 
over  time,  can  result  in  problems  eventually  being  deemed 
non-problems.  An  extraordinary  example  of  this  phenom- 
enon is  how  Shuttle  Program  managers  assumed  the  foam 
strike  on  STS-1 12  was  not  a  warning  sign  (see  Chapter  6). 

During  the  STS-1 13  Flight  Readiness  Review,  the  bipod 
foam  strike  to  STS-1 12  was  rationalized  by  simply  restat- 
ing earlier  assessments  of  foam  loss.  The  question  of  why 
bipod  foam  would  detach  and  strike  a  Solid  Rocket  Booster 
spawned  no  further  analysis  or  heightened  curiosity;  nor 
did  anyone  challenge  the  weakness  of  External  Tank  Proj- 
ect Manager's  argument  that  backed  launching  the  next 
mission.  After  STS-I13's  successful  flight,  once  again  the 
STS- 1 1 2  foam  event  was  not  discussed  at  the  STS- 1 07  Flight 
Readiness  Review.  The  failure  to  mention  an  outstanding 
technical  anomaly,  even  if  not  technically  a  violation  of 
NASA's  own  procedures,  desensitized  the  Shuttle  Program 
to  the  dangers  of  foam  striking  the  Thermal  Protection  Sys- 
tem, and  demonstrated  just  how  easily  the  flight  preparation 
process  can  be  compromised.  In  short,  the  dangers  of  bipod 
foam  got  "rolled-up,"  which  resulted  in  a  missed  opportuni- 
ty to  make  Shuttle  managers  aware  that  the  Shuttle  required, 
and  did  not  yet  have  a  fix  for  the  problem. 

Once  the  Coliinihia  foam  strike  was  discovered,  the  Mission 
Management  Team  Chairperson  asked  for  the  rationale  the 
STS-1 13  Flight  Readiness  Review  used  to  launch  in  spite 
of  the  STS- 1 12  foam  strike.  In  her  e-mail,  she  admitted  that 
the  analysis  used  to  continue  flying  was,  in  a  word,  "lousy" 
(Chapter  6).  This  admission  -  that  the  rationale  to  fly  was 
rubber-stamped  -  is,  to  say  the  least,  unsettling. 

The  Flight  Readiness  process  is  supposed  to  be  shielded 
from  outside  influence,  and  is  viewed  as  both  rigorous  and 
systematic.  Yet  the  Shuttle  Program  is  inevitably  influenced 
by  external  factors,  including,  in  the  case  of  the  STS- 107, 
schedule  demands.  Collectively,  such  factors  shape  how 
the  Program  establishes  mission  schedules  and  sets  budget 
priorities,  which  affects  safety  oversight,  workforce  levels, 
facility  maintenance,  and  contractor  workloads.  Ultimately, 
external  expectations  and  pressures  impact  even  data  collec- 
tion, trend  analysis,  information  development,  and  the  re- 


porting and  disposition  of  anomalies.  These  realities  contra- 
dict NASA's  optimistic  belief  that  pre-flight  reviews  provide 
true  safeguards  against  unacceptable  hazards.  The  schedule 
pressure  to  launch  International  Space  Station  Node  2  is  a 
powerful  example  of  this  point  (Section  6.2). 

The  premium  placed  on  maintaining  an  operational  sched- 
ule, combined  with  ever-decreasing  resources,  gradually  led 
Shuttle  managers  and  engineers  to  miss  signals  of  potential 
danger.  Foam  strikes  on  the  Orbiter's  Thermal  Protec- 
tion System,  no  matter  what  the  size  of  the  debris,  were 
"normalized"  and  accepted  as  not  being  a  "safety-of-flight 
risk."  Clearly,  the  risk  of  Thennal  Protection  damage  due  to 
such  a  strike  needed  to  be  better  understood  in  quantifiable 
terms.  External  Tank  foam  loss  should  have  been  eliminated 
or  mitigated  with  redundant  layers  of  protection.  If  there 
was  in  fact  a  strong  safety  culture  at  NASA,  safety  experts 
would  have  had  the  authority  to  test  the  actual  resilience  of 
the  leading  edge  Reinforced  Carbon-Carbon  panels,  as  the 
Board  has  done. 

Debris  Assessment  Team  Shortcomings 

Chapter  Six  details  the  Debris  Assessment  Team's  efforts  to 
obtain  additional  imagery  of  Columbia.  When  managers  in 
the  Shuttle  Program  denied  the  team's  request  for  imagery, 
the  Debris  Assessment  Team  was  put  in  the  untenable  posi- 
tion of  having  to  prove  that  a  safety-of-flight  issue  existed 
without  the  very  images  that  would  permit  such  a  determina- 
tion. This  is  precisely  the  opposite  of  how  an  effective  safety 
culture  would  act.  Organizations  that  deal  with  high-risk  op- 
erations must  always  have  a  healthy  fear  of  failure  -  opera- 
tions must  be  proved  safe,  rather  than  the  other  way  around. 
NASA  inverted  this  burden  of  proof. 

Another  crucial  failure  involves  the  Boeing  engineers  who 
conducted  the  Crater  analysis.  The  Debris  Assessment  Team 
relied  on  the  inputs  of  these  engineers  along  with  many  oth- 
ers to  assess  the  potential  damage  caused  by  the  foam  strike. 
Prior  to  STS- 107,  Crater  analysis  was  the  responsibility  of 
a  team  at  Boeing's  Huntington  Beach  facility  in  California, 
but  this  responsibility  had  recently  been  transferred  to 
Boeing's  Houston  office.  In  October  2002,  the  Shuttle  Pro- 
gram completed  a  risk  assessment  that  predicted  the  move  of 
Boeing  functions  from  Huntington  Beach  to  Houston  would 
increase  risk  to  Shuttle  missions  through  the  end  of  2003. 
because  of  the  small  number  of  experienced  engineers  who 
were  willing  to  relocate.  To  mitigate  this  risk,  NASA  and 
United  Space  Alliance  developed  a  transition  plan  to  run 
through  .lanuary  2003. 

The  Board  has  discovered  that  the  implementation  of  the 
transition  plan  was  incomplete  and  that  training  of  replace- 
ment personnel  was  not  uniform.  STS- 107  was  the  first 
mission  during  which  Johnson-based  Boeing  engineers 
conducted  analysis  without  guidance  and  oversight  from 
engineers  at  Huntington  Beach. 

Even  though  STS-107's  debris  strike  was  400  times  larger 
than  the  objects  Crater  is  designed  to  model,  neither  John- 
son engineers  nor  Program  managers  appealed  for  assistance 
from  the  more  experienced  Huntington  Beach  engineers. 
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Engineering  by  Viewgraphs 


The  Debris  Assessment  Team  presented  its  analysis  in  a  formal 
briefing  to  the  Mission  Evaluation  Room  that  relied  on  Power- 
Point slides  from  Boeing.  When  engineering  analyses  and  risk 
assessments  are  condensed  to  fit  on  a  standard  form  or  overhead 
slide,  information  is  inevitably  lost.  In  the  process,  the  prior- 
ity assigned  to  information  can  be  easily  misrepresented  by  its 
placement  on  a  chart  and  the  language  that  is  used.  Dr.  Edward 
Tufte  of  Yale  University,  an  e.xpert  in  information  presentation 
who  also  researched  communications  failures  in  the  Clicillenger 
accident,  studied  how  the  slides  used  by  the  Debris  Assessment 
Team  in  their  briefing  to  the  Mission  Evaluation  Room  misrep- 
resented key  information.'** 

The  slide  created  six  levels  of  hierarchy,  signified  by  the  title 
and  the  symbols  to  the  left  of  each  line.  These  levels  prioritized 
information  that  was  already  contained  in  1 1  simple  sentences. 
Tufte  also  notes  that  the  title  is  confusing.  "Review  of  Test  Data 
Indicates  Conservatism"  refers  not  to  the  predicted  tile  damage, 
but  to  the  choice  of  test  models  used  to  predict  the  damage. 

Only  at  the  bottom  of  the  slide  do  engineers  state  a  key  piece  of 
information;  that  one  estimate  of  the  debris  that  struck  Columbia 
was  640  times  larger  than  the  data  used  to  calibrate  the  model  on 
which  engineers  based  their  damage  assessments.  (Later  analy- 
sis showed  that  the  debris  object  was  actually  400  times  larger). 
This  difference  led  Tufte  to  suggest  that  a  more  appropriate 
headline  would  be  "Review  of  Test  Data  Indicates  Irrelevance 
of  Two  Models."  ''' 


Tufte  also  criticized  the  sloppy  language  on  the  slide.  "The 
vaguely  quantitative  words  'significant"  and  'significantly'  are 
used  5  times  on  this  slide,"  he  notes,  "w  ith  de  facto  meanings 
ranging  from  'detectable  in  largely  irrelevant  calibration  case 
study'  to  'an  amount  of  damage  so  that  everyone  dies'  to  'a  dif- 
ference of  640-fold.'  "  *  Another  example  of  sloppiness  is  that 
"cubic  inches"  is  written  inconsistently:  "3cu.  In,"  "1920cu  in," 
and  "3  cu  in."  While  such  inconsistencies  might  seem  minor,  in 
highly  technical  fields  like  aerospace  engineering  a  misplaced 
decimal  point  or  mistaken  unit  of  measurement  can  easily 
engender  inconsistencies  and  inaccuracies.  In  another  phrase 
"Test  results  do  show  that  it  is  possible  at  sufficient  mass  and 
velocity,"  the  word  "it"  actually  refers  to  "damage  to  the  protec- 
tive tiles." 

As  information  gets  passed  up  an  organization  hierarchy,  from 
people  who  do  analysis  to  mid-level  managers  to  high-level 
leadership,  key  explanations  and  supporting  information  is  fil- 
tered out.  In  this  context,  it  is  easy  to  understand  how  a  senior 
manager  might  read  this  PowerPoint  slide  and  not  realize  that  it 
addresses  a  life-threatening  situation. 

At  many  points  during  its  investigation,  the  Board  was  sur- 
prised to  receive  similar  presentation  slides  from  NASA  offi- 
cials in  place  of  technical  reports.  The  Board  views  the  endemic 
use  of  PowerPoint  briefing  slides  instead  of  technical  papers  as 
an  illustration  of  the  problematic  methods  of  technical  com- 
munication at  NASA. 


The  vaguely  quanlitaiive  words  "significant"  and 
"significantly"  are  used  5  times  on  this  slide,  with  tie  fm- 
meanings  ranging  from  "detectable  in  largely  irrelevant 
calibration  case  study"  lo  "an  amount  of  damage  so  that 
everyone  dies"  to  "a  difference  of  640-fold."    None  of 
these  5  usages  appears  lo  refer  to  the  technical  meaning 
of  "statistical  significance." 


i 


Review  Of  Test  Data  Indicates  Conservatism  for  Tile< 
Penetration 


The  existing  SOFI  on  tile  test  data  used  to  create  Crater 
was  reviewed  along  with  STS-107  Southwest  Research  data 

-  Crater  overpredicted  penetration  of  t.le  coating 
significantly 

•  Initial  penetration  to  described  by  normal  velocity  4 

•  Vanes  With  volume/mass  of  pro]ectile(e  g  .  200ft/sec  for 
3cu  In) 

•  Significant  energy  is  required  for  the  softer  SOFlj 
to  penetrate  the  relatively  hard  tile  1 

■    Test  results  do  show  thaQys-pOsslEie  at  sufficient  mass 
and  velocity 

•  Conversely,  once  tile  Is  penetrated  SOFI  can  cause 
significant  damage 

.    Minor  vanations  in  total  energy  (above  penetration  level) 
can  cause  significant  tile  damage 

-  Flight  condition  is  significantly  outside  of  test  database 

•  Volume  of  ramp  is  1920cu  in  vs  3  cu  In  for  test 


The  low  resolution  of  PowerPoint  slides  promotes 
the  use  of  compressed  phrases  like  "Tile  Penetration." 
As  is  the  case  here,  such  phrases  may  well  be  ambiquous. 
(The  low  resolution  and  large  font  generate  3  typographic 
orphans,  lonely  words  dangling  on  a  seperale  line.) 


This  vague  pronoun  reference  "it"  alludes  10  damafie 
to  the  protective  ;//fi. which  caused  the  destruction  of  the 
Columbia.   The  slide  weakens  important  material  with 
ambiquous  language  (sentence  fragments,  passive  voice, 
multiple  meanings  of  "significant").   The  .1  reports 
were  created  by  engineers  for  high-level  NASA  officials 
who  were  deciding  whether  the  threat  of  wing  damage 
required  further  investigation  before  the  Columbia 
allcmpled  return.   The  officials  were  satisfied  that  the 
reports  indicated  that  the  Columbia  was  not  in  danger, 
and  no  allenipts  to  further  examine  the  threat  were 
made.   The  slides  were  pan  of  an  oral  presentation  and 
also  were  circulated  as  e-mail  attachments. 

In  this  slide  the  same  unit  of  measure  for  volume 
(cubic  inches)  is  shown  a  different  way  every  time 

.^cu.  in  I920CU.  in  3  cu.  in 

rather  than  in  clear  and  tidy  exponential  form  1920  in'. 
Perhaps  the  available  font  cannot  show  exponents. 
Shakiness  in  units  of  measurement  provokes  concern. 
Slides  that  use  hierarchical  bullet-outlines  here  do  not 
handle  statistical  data  and  scientific  notation  gracefully. 
If  PowerPoint  is  a  corporate-mandated  format  for  all 
engineering  reports,  then  some  competent  scientific 
typography  (rather  than  the  PP  market-pitch  style)  is 
essential.    In  this  slide,  the  typography  is  so  choppy  and 
clunky  thai  il  impedes  understanding. 


The  analysis  by  Dr.  Edward  Tufte  of  f/ie  slide  from  fhe  Debris  Assessmenf  Team  briefing.  fSOFI=Sproy-On  Foam  /nsu/afionj 


Repd«t    Volume 


AUBUST     2003 


1    9   1 


COLUMBIA 

ACCIDENT  INVESTIGATION  BOARD 


who  might  have  cautioned  against  using  Crater  so  far  out- 
side its  validated  limits.  Nor  did  safety  personnel  provide 
any  additional  oversight.  NASA  failed  to  connect  the  dots: 
the  engineers  who  misinterpreted  Crater  -  a  tool  already 
unsuited  to  the  task  at  hand  -  were  the  very  ones  the  Shuttle 
Program  identified  as  engendering  the  most  risk  in  their 
transition  from  Huntington  Beach.  The  Board  views  this  ex- 
ample as  characteristic  of  the  greater  turbulence  the  Shuttle 
Program  experienced  in  the  decade  before  Cohimhia  as  a 
result  of  workforce  reductions  and  management  reforms. 

Mission  Management  Team  Shortcomings 

In  the  Board's  view,  the  decision  to  fly  STS-1 13  without  a 
compelling  explanation  for  why  bipod  foam  had  separated 
on  ascent  during  the  preceding  mission,  combined  with  the 
low  number  of  Mission  Management  Team  meetings  during 
STS-1 07,  indicates  that  the  Shuttle  Program  had  become 
overconfident.  Over  time,  the  organization  determined  it  did 
not  need  daily  meetings  during  a  mission,  despite  regula- 
tions that  state  otherwise. 

Status  update  meetings  should  provide  an  opportunity  to  raise 
concerns  and  hold  discussions  across  structural  and  technical 
boundaries.  The  leader  of  such  meetings  must  encourage 
participation  and  guarantee  that  problems  are  assessed  and 
resolved  fully.  All  voices  must  be  heard,  which  can  be  dif- 
ficult when  facing  a  hierarchy.  An  employee's  location  in  the 
hierarchy  can  encourage  silence.  Organizations  interested  in 
safety  must  take  steps  to  guarantee  that  all  relevant  informa- 
tion is  presented  to  decision-makers.  This  did  not  happen  in 
the  meetings  during  the  Cohimhia  mission  (.see  Chapter  6). 
For  instance,  e-mails  from  engineers  at  Johnson  and  Langley 
conveyed  the  depth  of  their  concern  about  the  foam  strike, 
the  questions  they  had  about  its  implications,  and  the  actions 
they  wanted  to  take  as  a  follow-up.  However,  these  e-mails 
did  not  reach  the  Mission  Management  Team. 

The  failure  to  convey  the  urgency  of  engineering  concerns 
was  caused,  at  least  in  part,  by  organizational  structure  and 
spheres  of  authority.  The  Langley  e-mails  were  circulated 
among  co-workers  at  Johnson  who  explored  the  possible  ef- 
fects of  the  foam  .strike  and  its  consequences  for  landing.  Yet, 
like  Debris  Assessment  Team  Co-Chair  Rodney  Rocha,  they 
kept  their  concerns  within  local  channels  and  did  not  forward 
them  to  the  Mission  Management  Team.  They  were  separated 
from  the  decision-making  process  by  distance  and  rank. 

Similarly,  Mission  Management  Team  participants  felt  pres- 
sured to  remain  quiet  unless  discussion  turned  to  their  par- 
ticular area  of  technological  or  system  expertise,  and,  even 
then,  to  be  brief.  The  initial  damage  assessment  briefing 
prepared  for  the  Mission  Evaluation  Room  was  cut  down 
considerably  in  order  to  make  it  "fit"  the  schedule.  Even  so, 
it  took  40  minutes.  It  was  cut  down  further  to  a  three-minute 
discussion  topic  at  the  Mission  Management  Team.  Tapes  of 
STS-107  Mission  Management  Team  sessions  reveal  a  no- 
ticeable "rush"  by  the  meeting's  leader  to  the  preconceived 
bottom  line  that  there  was  "no  safety-of- flight"  issue  (see 
Chapter  6).  Program  managers  created  huge  barriers  against 
dissenting  opinions  by  stating  preconceived  conclusions 
based  on  subjective  knowledge  and  experience,  rather  than 


on  solid  data.  Managers  demonstrated  little  concern  for  mis- 
sion safety. 

Organizations  with  strong  safety  cultures  generally  acknowl- 
edge that  a  leader's  best  response  to  unanimous  consent  is  to 
play  devil's  advocate  and  encourage  an  exhaustive  debate. 
Mission  Management  Team  leaders  failed  to  seek  out  such 
minority  opinions.  Imagine  the  difference  if  any  Shuttle 
manager  had  simply  asked,  "Prove  to  me  that  Columbia  has 
mn  been  harmed." 

Similarly,  organizations  committed  to  effective  communica- 
tion seek  avenues  through  which  unidentified  concerns  and 
dissenting  insights  can  be  raised,  so  that  weak  signals  are 
not  lost  in  background  noise.  Common  methods  of  bringing 
minority  opinions  to  the  fore  include  hazard  reports,  sug- 
gestion programs,  and  empowering  employees  to  call  "time 
out"  (Chapter  10).  For  these  methods  to  be  effective,  they 
must  mitigate  the  fear  of  retribution,  and  management  and 
technical  staff  must  pay  attention.  Shuttle  Program  hazard 
reporting  is  seldom  used,  safety  time  outs  are  at  times  disre- 
garded, and  informal  efforts  to  gain  support  are  squelched. 
The  very  fact  that  engineers  felt  inclined  to  conduct  simulat- 
ed blown  tire  landings  at  Ames  "after  hours,"  indicates  their 
reluctance  to  bring  the  concern  up  in  established  channels. 

Safety  Shortcomings 

The  Board  believes  that  the  safety  organization,  due  to  a 
lack  of  capability  and  resources  independent  of  the  Shuttle 
Program,  was  not  an  effective  voice  in  discussing  technical 
issues  or  mission  operations  pertaining  to  STS-107.  The 
safety  personnel  present  in  the  Debris  Assessment  Team, 
Mission  Evaluation  Room,  and  on  the  Mission  Management 
Team  were  largely  silent  during  the  events  leading  up  to  the 
loss  of  Columbia.  That  silence  was  not  merely  a  failure  of 
safety,  but  a  failure  of  the  entire  organization. 

7.6    Findings  and  Recommendations 

The  evidence  that  supports  the  organizational  causes  also 
led  the  Board  to  conclude  that  NASA's  current  organization, 
which  combines  in  the  Shuttle  Program  all  authority  and 
responsibility  for  schedule,  cost,  manifest,  safety,  technical 
requirements,  and  waivers  to  technical  requirements,  is  not 
an  effective  check  and  balance  to  achieve  safety  and  mission 
assurance.  Further,  NASA's  Office  of  Safety  and  Mission 
Assurance  does  not  have  the  independence  and  authority 
that  the  Board  and  many  outside  reviews  believe  is  neces- 
sary. Consequently,  the  Space  Shuttle  Program  does  not 
consistently  demonstrate  the  characteristics  of  organizations 
that  effectively  manage  high  risk.  Therefore,  the  Board  of- 
fers the  following  Findings  and  Recommendations; 


Findings: 


F7.I-1 


Throughout  its  history,  NASA  has  consistently 
struggled  to  achieve  viable  safety  programs  and 
adjust  them  to  the  constraints  and  vagaries  of 
changing  budgets.  Yet.  according  to  multiple  high 
level  independent  reviews.  NASA's  safety  system 
has  fallen  short  of  the  mark. 
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F7.4-1 


F7.4-2 


R.4-3 


R.4-4 


F7.4-5 


F7.4-6 


F7.4-7 


F7.4-8 


F7.4-9 


R.4-10 


R.4-11 


R.4-12 


The  Associate  Administrator  for  Safety  and  Mis- 
sion Assurance  is  not  responsible  for  safety  and 
mission  assurance  execution,  as  intended  by  the  F7.4-13 

Rogers  Commission,  but  is  responsible  for  Safety 
and  Mission  Assurance  policy,  advice,  coordina- 
tion, and  budgets.  This  view  is  consistent  with 
NASA's  recent  philosophy  of  management  at  a 
strategic  level  at  NASA  Headquarters  but  contrary 
to  the  Rogers'  Commission  recommendation. 
Safety  and  Mission  Assurance  organizations  sup- 
porting the  Shuttle  Program  are  largely  dependent 
upon  the  Program  for  funding,  which  hampers 
their  status  as  independent  advisors. 
Over  the  last  two  decades,  little  to  no  progress  has 
been  made  toward  attaining  integrated,  indepen- 
dent, and  detailed  analyses  of  risk  to  the  Space  R7.5-1 
Shuttle  system. 

System  safety  engineering  and  management  is 
separated  from  mainstream  engineering,  is  not 
vigorous  enough  to  have  an  impact  on  system  de- 
sign, and  is  hidden  in  the  other  safety  disciplines 
at  NASA  Headquarters. 

Risk  information  and  data  from  hazard  analy.ses 
are  not  communicated  effectively  to  the  risk  as- 
sessment and  mission  assurance  processes.  The 
Board  could  not  find  adequate  application  of  a 
process,  database,  or  metric  analysis  tool  that 
took  an  integrated,  systemic  view  of  the  entire 
Space  Shuttle  system. 

The  Space  Shuttle  Systems  Integration  Office 
handles  all  Shuttle  systems  except  the  Orbiter. 
Therefore,  it  is  not  a  true  integration  office. 
When  the  Integration  Office  convenes  the  Inte- 
gration Control  Board,  the  Orbiter  Office  usually 
does  not  send  a  representative,  and  its  staff  makes 
verbal  inputs  only  when  requested. 
The  Integration  office  did  not  have  continuous 
responsibility   to   integrate   responses  to  bipod 
foam  shedding  from  various  offices.  Sometimes 
the  Orbiter  Office  had  responsibility,  sometimes 
the  External  Tank  Office  at  Marshall  Space  Flight 
Center  had  responsibility,  and  sometime  the  bi- 
pod shedding  did  not  result  in  any  designation  of 
an  In-Flight  Anomaly.  Integration  did  not  occur 
NASA  information  databases  such  as  The  Prob- 
lem Reporting  and  Corrective  Action  and  the  R7.5-2 
Web  Program  Compliance  Assurance  and  Status 
System  are  marginally  effective  decision  tools. 
Senior  Safety,  Reliability  &  Quality  Assurance 
and  element  managers  do  not  use  the  Lessons  R7.5-3 
Learned  Information  System  when  making  de- 
cisions. NASA  subsequently  does  not  have  a 
constructive  program  to  use  past  lessons  to  edu- 
cate engineers,  managers,  astronauts,  or  safety 
personnel. 

The  Space  Shuttle  Program  has  a  wealth  of  data 
tucked  away  in  multiple  databases  without  a 
convenient  way  to  integrate  and  use  the  data  for 
management,  engineering,  or  safety  decisions. 
The  dependence  of  Safety,  Reliability  &  Quality 
Assurance  personnel  on  Shuttle  Program  sup- 
port limits  their  ability  to  oversee  operations  and 


communicate  potential  problems  throughout  the 
organization. 

There  are  conflicting  roles,  responsibilities,  and 
guidance  in  the  Space  Shuttle  safety  programs. 
The  Safety  &  Mission  Assurance  Pre-Launch  As- 
.sessment  Review  process  is  not  recognized  by  the 
Space  Shuttle  Program  as  a  requirement  that  must 
be  followed  (NSTS  22778).  Failure  to  consistent- 
ly apply  the  Pre-Launch  Assessment  Review  as  a 
requirements  document  creates  confusion  about 
roles  and  responsibilities  in  the  NASA  safety  or- 
sanization. 


Recommendations: 


Establish  an  independent  Technical  Engineer- 
ing Authority  that  is  responsible  for  technical 
requirements  and  all  waivers  to  them,  and  will 
build  a  disciplined,  systematic  approach  to 
identifying,  analyzing,  and  controlling  hazards 
throughout  the  life  cycle  of  the  Shuttle  System. 
The  independent  technical  authority  does  the  fol- 
lowing as  a  minimum: 

•  Develop  and  maintain  technical  standards 
for  all  Space  Shuttle  Program  projects  and 
elements 

•  Be  the  sole  waiver-granting  authority  for 
all  technical  standards 

•  Conduct  trend  and  risk  analysis  at  the  sub- 
system, system,  and  enterprise  levels 

•  Own  the  failure  mode,  effects  analysis  and 
hazard  reporting  systems 

•  Conduct  integrated  hazard  analysis 

•  Decide  what  is  and  is  not  an  anomalous 
event 

•  Independently  verify  launch  readiness 

•  Approve  the  provisions  of  the  recertifica- 
tion  program  called  for  in  Recommenda- 
tion R9. 1-1 

The  Technical  Engineering  Authority  should  be 
funded  directly  from  NASA  Headquarters,  and 
should  have  no  connection  to  or  responsibility  for 
schedule  or  program  cost. 

NASA  Headquarters  Office  of  Safety  and  Mission 
Assurance  should  have  direct  line  authority  over 
the  entire  Space  Shuttle  Program  safety  organiza- 
tion and  should  be  independently  resourced. 
Reorganize  the  Space  Shuttle  Integration  Office 
to  make  it  capable  of  integrating  all  elements  of 
the  Space  Shuttle  Program,  including  the  Orbiter. 
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Chapter  8 


History  As  Cause: 
Columbia  and  Challenger 


The  Board  began  its  investigation  with  two  central  ques- 
tions about  NASA  decisions.  Why  did  NASA  continue  to  fly 
with  known  foam  debris  problems  in  the  years  preceding  the 
Coliimhiu  launch,  and  why  did  NASA  managers  conclude 
that  the  foam  debris  strike  81.9  seconds  into  Columbia^ 
flight  was  not  a  threat  to  the  safety  of  the  mission,  despite 
the  concerns  of  their  engineers? 

8.1     Echoes  of  Challenger 

As  the  investigation  progressed.  Board  member  Dr.  Sally 
Ride,  who  also  served  on  the  Rogers  Commission,  observed 
that  there  were  "echoes"  of  Challeimer  in  Cohiiuhia.  Ironi- 
cally, the  Rogers  Commission  investigation  into  Clialleniier 
started  with  two  remarkably  similar  central  questions:  Why 
did  NASA  continue  to  fly  with  known  O-ring  erosion  prob- 
lems in  the  years  before  the  Challeniier  launch,  and  why,  on 
the  eve  of  the  Challenj^er  launch,  did  NASA  managers  decide 
that  launching  the  mission  in  such  cold  temperatures  was  an 
acceptable  risk,  despite  the  concerns  of  their  engineers? 

The  echoes  did  not  stop  there.  The  foam  debris  hit  was  not 
the  single  cause  of  the  Columbia  accident,  just  as  the  failure 
of  the  joint  seal  that  permitted  O-ring  erosion  was  not  the 
single  cause  of  Clialleiiffer.  Both  Columbia  and  Challeniier 
were  lost  also  because  of  the  failure  of  NASA's  organiza- 
tional system.  Part  Two  of  this  report  cites  failures  of  the 
three  parts  of  NASA's  organizational  system.  This  chapter 
shows  how  previous  political,  budgetary,  and  policy  deci- 
sions by  leaders  at  the  White  House.  Congress,  and  NASA 
(Chapter  5)  impacted  the  Space  Shuttle  Program's  structure, 
culture,  and  safety  system  (Chapter  7).  and  how  these  in  turn 
resulted  in  flawed  decision-making  (Chapter  6)  for  both  ac- 
cidents. The  explanation  is  about  system  effects:  how  actions 
taken  in  one  layer  of  NASA's  organizational  system  impact 
other  layers.  History  is  not  just  a  backdrop  or  a  scene-setter 
History  is  cause.  History  set  the  Columbia  and  Cluilleiii>er 
accidents  in  motion.  Although  Part  Two  is  separated  into 
chapters  and  sections  to  make  clear  what  happened  in  the 
political  environment,  the  organization,  and  managers'  and 


engineers'  decision-making,  the  three  worked  together.  Each 
is  a  critical  link  in  the  causal  chain. 

This  chapter  shows  that  both  accidents  were  "failures  of 
foresight"  in  which  history  played  a  prominent  role.'  First, 
the  history  of  engineering  decisions  on  foam  and  O-ring 
incidents  had  identical  trajectories  that  "normalized"  these 
anomalies,  so  that  flying  with  these  flaws  became  routine 
and  acceptable.  Second.  NASA  history  had  an  effect.  In  re- 
sponse to  White  House  and  Congressional  mandates.  NASA 
leaders  took  actions  that  created  systemic  organizational 
flaws  at  the  time  of  Challeniier  that  were  also  present  for 
Columbia.  The  final  section  compares  the  two  critical  deci- 
sion sequences  immediately  before  the  loss  of  both  Orbit- 
ers  -  the  pre-launch  teleconference  for  Challeni>er  and  the 
post-launch  foam  strike  discussions  for  Columbia.  It  shows 
history  again  at  work:  how  past  definitions  of  risk  combined 
with  systemic  problems  in  the  NASA  organization  caused 
both  accidents. 

Connecting  the  parts  of  NASA's  organizational  system  and 
drawing  the  parallels  with  Challeni>er  demonstrate  three 
things.  First,  despite  all  the  post-Challeniier  changes  at 
NASA  and  the  agency's  notable  achievements  since,  the 
causes  of  the  institutional  failure  responsible  for  Challeniier 
have  not  been  fixed.  Second,  the  Board  strongly  believes 
that  if  these  persistent,  systemic  flaws  are  not  resolved, 
the  scene  is  set  for  another  accident.  Therefore,  the  recom- 
mendations for  change  are  not  only  for  fixing  the  Shuttle's 
technical  system,  but  also  for  fixing  each  part  of  the  orga- 
nizational system  that  produced  Columbia's  failure.  Third, 
the  Board's  focus  on  the  context  in  which  decision  making 
occurred  does  not  mean  that  individuals  are  not  responsible 
and  accountable.  To  the  contrary,  individuals  always  must 
assume  responsibility  for  their  actions.  What  it  does  mean 
is  that  NASA's  problems  cannot  be  solved  simply  by  retire- 
ments, resignations,  or  transferring  personnel.- 

The  constraints  under  which  the  agency  has  operated 
throughout  the  Shuttle  Program  have  contributed  to  both 
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Shuttle  accidents.  Although  NASA  leaders  have  played 
an  important  role,  these  constraints  were  not  entirely  of 
NASA's  own  making.  The  White  House  and  Congress  must 
recognize  the  role  of  their  decisions  in  this  accident  and  take 
responsibility  for  safety  in  the  future. 

8.2  Failures  of  Foresight:  Two  Decision 
Histories  and  the  Normalization  of 
Deviance 

Foam  loss  may  have  occurred  on  all  missions,  and  left  bipod 
ramp  foam  loss  occurred  on  10  percent  of  the  flights  for 
which  visible  evidence  exists.  The  Board  had  a  hard  time 
understanding  how,  after  the  bitter  lessons  of  Clnilleiif;cr. 
NASA  could  have  failed  to  identify  a  similar  trend.  Rather 
than  view  the  foam  decision  only  in  hindsight,  the  Board 
tried  to  see  the  foam  incidents  as  NASA  engineers  and  man- 
agers saw  them  as  they  made  their  decisions.  This  section 
gives  an  insider  perspective:  how  NASA  defined  risk  and 
how  those  definitions  changed  over  time  for  both  foam  debris 
hits  and  0-ring  erosion.  In  both  cases,  engineers  and  manag- 
ers conducting  risk  assessments  continually  normalized  the 
technical  deviations  they  found.'  In  all  official  engineering 
analyse*  and  launch  recommendations  prior  to  the  accidents, 
evidence  that  the  design  was  not  performing  as  expected  was 
reinteipreted  as  acceptable  and  non-deviant,  which  dimin- 
ished perceptions  of  risk  throughout  the  agency. 

The  initial  Shuttle  design  predicted  neither  foam  debris 
problems  nor  poor  sealing  action  of  the  Solid  Rocket  Boost- 
er joints.  To  experience  either  on  a  mission  was  a  violation 
of  design  specifications.  These  anomalies  were  signals  of 
potential  danger,  not  something  to  be  tolerated,  but  in  both 
cases  after  the  first  incident  the  engineering  analysis  con- 
cluded that  the  design  could  tolerate  the  damage.  These  en- 
gineers decided  to  implement  a  temporary  fix  and/or  accept 
the  risk,  and  fly.  For  both  0-rings  and  foam,  that  first  deci- 
sion was  a  turning  point.  It  established  a  precedent  for  ac- 
cepting, rather  than  eliminating,  these  technical  deviations. 
As  a  result  of  this  new  classification,  subsequent  incidents  of 
O-ring  erosion  or  foam  debris  strikes  were  not  defined  as 
signals  of  danger,  but  as  evidence  that  the  design  was  now 
acting  as  predicted.  Engineers  and  managers  incorporated 
worsening  anomalies  into  the  engineering  experience  base, 
which  functioned  as  an  elastic  waistband,  expanding  to  hold 
larger  deviations  from  the  original  design.  Anomalies  that 
did  not  lead  to  catastrophic  failure  were  treated  as  a  .source 
of  valid  engineering  data  that  justified  further  flights.  These 
anomalies  were  translated  into  a  safety  margin  that  was  ex- 
tremely influential,  allowing  engineers  and  managers  to  add 
incrementally  to  the  amount  and  seriousness  of  damage  that 
was  acceptable.  Both  O-ring  erosion  and  foam  debris  events 
were  repeatedly  "addressed"  in  NASA's  Flight  Readiness 
Reviews  but  never  fully  resolved.  In  both  cases,  the  engi- 
neering analysis  was  incomplete  and  inadequate.  Engineers 
understood  what  was  happening,  but  they  never  understood 
why.  NASA  continued  to  implement  a  series  of  small  correc- 
tive actions,  living  with  the  problems  until  it  was  too  late."* 

.  NASA  documents  show  how  official  classifications  of  risk 
were  downgraded  over  time.^  Program  managers  designated 
both  the  foam  problems  and  O-ring  erosion  as  "acceptable 


risks"  in  Flight  Readiness  Reviews.  NASA  managers  also 
assigned  each  bipod  foam  event  In-Ftight  Anomaly  status, 
and  then  removed  the  designation  as  corrective  actions 
were  implemented.  But  when  major  bipod  foam-shedding 
occurred  on  STS-1 12  in  October  2002,  Program  manage- 
ment did  not  assign  an  In-Flight  Anomaly.  Instead,  it  down- 
graded the  problem  to  the  lower  status  of  an  "action"  item. 
Before  Cluilleiiiier.  the  problematic  Solid  Rocket  Booster 
joint  had  been  elevated  to  a  Criticality  1  item  on  NASA's 
Critical  Items  List,  which  ranked  Shuttle  components  by 
failure  consequences  and  noted  why  each  was  an  accept- 
able risk.  The  joint  was  later  demoted  to  a  Criticality  l-R 
(redundant),  and  then  in  the  month  before  Cluilleiii'er's 
launch  was  "closed  out"  of  the  problem-reporting  system. 
Prior  to  both  accidents,  this  demotion  from  high-risk  item 
to  low-risk  item  was  very  similar,  but  with  some  important 
differences.  Damaging  the  Orbiter's  Thermal  Protection 
System,  especially  its  fragile  tiles,  was  normalized  even  be- 
fore Shuttle  launches  began:  it  was  expected  due  to  forces 
at  launch,  orbit,  and  re-entry.''  So  normal  was  replacement 
of  Thermal  Protection  System  materials  that  NASA  manag- 
ers budgeted  for  tile  cost  and  turnaround  maintenance  time 
from  the  start. 

It  was  a  small  and  logical  next  step  for  the  discovery  of  foam 
debris  damage  to  the  tiles  to  be  viewed  by  NASA  as  part  of  an 
already  existing  maintenance  problem,  an  assessment  based 
on  experience,  not  on  a  thorough  hazard  analysis.  Foam  de- 
bris anomalies  came  to  be  categorized  by  the  reassuring 
term  "in-family,"  a  formal  classification  indicating  that  new 
occurrences  of  an  anomaly  were  within  the  engineering  ex- 
perience base.  "In-family"  was  a  strange  term  indeed  for  a 
violation  of  system  requirements.  Although  "in-family"  was 
a  designation  introduced  posX-Clnilleiif^er  to  separate  prob- 
lems by  seriousness  so  that  "out-of-family"  problems  got 
more  attention,  by  definition  the  problems  that  were  shifted 
into  the  lesser  "in-family"  category  got  less  attention.  The 
Board's  investigation  uncovered  no  paper  trail  showing  es- 
calating concern  about  the  foam  problem  like  the  one  that 
Solid  Rocket  Booster  engineers  left  prior  to  Challeui'erP 
So  ingrained  was  the  agency's  belief  that  foam  debris  was 
not  a  threat  to  flight  safety  that  in  press  briefings  after  the 
Coluinbia  accident,  the  Space  Shuttle  Program  Manager 
still  discounted  the  foam  as  a  probable  cause,  saying  that 
Shuttle  managers  were  "comfortable"  with  their  previous 
risk  assessments. 

From  the  beginning,  NASA's  belief  about  both  these  prob- 
lems was  affected  by  the  fact  that  engineers  were  evaluat- 
ing them  in  a  work  environment  where  technical  problems 
were  nornial.  Although  management  treated  the  Shuttle 
as  operational,  it  was  in  reality  an  experimental  vehicle. 
Many  anomalies  were  expected  on  each  mission.  Against 
this  backdrop,  an  anomaly  was  not  in  itself  a  warning  sign 
of  impending  catastrophe.  Another  contributing  factor  was 
that  both  foam  debris  strikes  and  O-ring  erosion  events  were 
examined  separately,  one  at  a  time.  Individual  incidents 
were  not  read  by  engineers  as  strong  signals  of  danger 
What  NASA  engineers  and  managers  saw  were  pieces  of  ill- 
structured  problems.**  An  incident  of  O-ring  erosion  or  foam 
bipod  debris  would  be  followed  by  several  launches  where 
the  machine  behaved  properly,  so  that  signals  of  danger 
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were  followed  by  all-clear  signals  -  in  other  words,  NASA 
managers  and  engineers  were  receiving  mixed  signals.'' 
Some  signals  defined  as  weak  at  the  time  were,  in  retrospect, 
warnings  of  danger.  Foam  debris  damaged  tile  was  assumed 
(erroneously)  not  to  pose  a  danger  to  the  wing.  If  a  primary 
0-ring  failed,  the  secondary  was  assumed  (erroneously) 
to  provide  a  backup.  Finally,  because  foam  debris  strikes 
were  occurring  frequently,  like  O-ring  erosion  in  the  years 
before  Clutlleimer,  foam  anomalies  became  routine  signals 
-  a  nomial  part  of  Shuttle  operations,  not  signals  of  danger. 
Other  anomalies  gave  signals  that  were  strong,  like  sviring 
malfunctions  or  the  cracked  balls  in  Ball  Strut  Tie  Rod  As- 
semblies, which  had  a  clear  relationship  to  a  "loss  of  mis- 
sion." On  those  occasions,  NASA  stood  down  from  launch, 
sometimes  for  months,  while  the  problems  were  corrected. 
In  contrast,  foam  debris  and  eroding  O-rings  were  defined 
as  nagging  issues  of  seemingly  little  consequence.  Their 
significance  became  clear  only  in  retrospect,  after  lives  had 
been  lost. 

History  became  cause  as  the  repeating  pattern  of  anomalies 
was  ratified  as  safe  in  Flight  Readiness  Reviews.  The  official 
definitions  of  risk  assigned  to  each  anomaly  in  Flight  Readi- 
ness Reviews  limited  the  actions  taken  and  the  resources 
spent  on  these  problems.  Two  examples  of  the  road  not  taken 
and  the  devastating  implications  for  the  future  occuned  close 
in  time  to  both  accidents.  On  the  October  2002  launch  of 
STS-II2,  a  large  piece  of  bipod  ramp  foam  hit  and  dam- 
aged the  External  Tank  Attachment  ring  on  the  Solid  Rocket 
Booster  skirt,  a  strong  signal  of  danger  10  years  after  the  last 
known  bipod  ramp  foam  event.  Prior  to  CludlcniU'r.  there 
was  a  comparable  surprise.  After  a  January  1985  launch,  for 
which  the  Shuttle  sat  on  the  launch  pad  for  three  consecutive 
nights  of  unprecedented  cold  temperatures,  engineers  discov- 
ered upon  the  Orbiter's  return  that  hot  gases  had  eroded  the 
primary  and  reached  the  secondary  O-ring,  blackening  the 
putty  in  between  -  an  indication  that  the  joint  nearly  failed. 

But  accidents  are  not  always  preceded  by  a  wake-up  call.'" 
In  1983,  engineers  realized  they  needed  data  on  the  rela- 
tionship between  cold  temperatures  and  O-ring  erosion. 
However,  the  task  of  getting  better  temperature  data  stayed 
on  the  back  burner  because  of  the  definition  of  risk:  the 
primary  erosion  was  within  the  experience  base;  the  sec- 
ondary O-ring  (thought  to  be  redundant)  was  not  damaged 
and,  significantly,  there  was  a  low  probability  that  such  cold 
Florida  temperatures  would  recur."  The  scorched  putty,  ini- 
tially a  strong  signal,  was  redefined  after  analysis  as  weak. 
On  the  eve  of  the  Cluillen^er  launch,  when  cold  temperature 
became  a  concern,  engineers  had  no  test  data  on  the  effect 
of  cold  temperatures  on  O-ring  erosion.  Before  Columbia. 
engineers  concluded  that  the  damage  from  the  STS-112 
foam  hit  in  October  2002  was  not  a  threat  to  flight  safety. 
The  logic  was  that,  yes,  the  foam  piece  was  large  and  there 
was  damage,  but  no  serious  consequences  followed.  Further, 
a  hit  this  size,  like  cold  temperature,  was  a  low-probability 
event.  After  analysis,  the  biggest  foam  hit  to  date  was  re- 
defined as  a  weak  signal.  Similar  self-defeating  actions  and 
inactions  followed.  Fngineers  were  again  dealing  with  the 
poor  quality  of  tracking  camera  images  of  strikes  during 
ascent.  Yet  NASA  took  no  steps  to  improve  imagery  and 
took  no  immediate  action  to  reduce  the  risk  of  bipod  ramp 


foam  shedding  and  potential  damage  to  the  Orbiter  before 
Coliinihia.  Furthermore,  NASA  performed  no  tests  on  what 
would  happen  if  a  wing  leading  edge  were  struck  by  bipod 
foam,  even  though  foam  had  repeatedly  separated  from  the 
External  Tank. 

During  the  Challenger  investigation,  Rogers  Commis- 
sion member  Dr.  Richard  Feynman  famously  compared 
launching  Shuttles  with  known  problems  to  playing  Russian 
roulette.'-  But  that  characterization  is  only  possible  in  hind- 
sight. It  is  not  how  NASA  personnel  perceived  the  risks  as 
they  were  being  assessed,  one  launch  at  a  time.  Playing  Rus- 
sian roulette  implies  that  the  pLstol-holder  realizes  that  death 
might  be  imminent  and  still  takes  the  risk.  For  both  foam 
debris  and  O-ring  erosion,  fixes  were  in  the  works  at  the  time 
of  the  accidents,  but  there  was  no  rush  to  complete  them  be- 
cause neither  problem  was  defined  as  a  show-stopper.  Each 
time  an  incident  occuired,  the  Flight  Readiness  process 
declared  it  safe  to  continue  flying.  Taken  one  at  a  time,  each 
decision  seemed  correct.  The  agency  allocated  attention  and 
resources  to  these  two  problems  accordingly.  The  conse- 
quences of  living  with  both  of  these  anomalies  were,  in  its 
view,  minor.  Not  all  engineers  agreed  in  the  months  immedi- 
ately preceding  Cluillein^cr.  but  the  dominant  view  at  NASA 
-  the  managerial  view  -  was,  as  one  manager  put  it,  "we 
were  just  eroding  rubber  O-rings,"  which  was  a  low-cost 
problem."  The  financial  consequences  of  foam  debris  also 
were  relatively  low:  replacing  tiles  extended  the  turnaround 
time  between  launches.  In  both  cases,  NASA  was  comfort- 
able with  its  analyses.  Prior  to  each  accident,  the  agency  saw 
no  greater  consequences  on  the  horizon. 

8.3    System  Effects:  The  Impact  of  History 
AND  Politics  on  Risky  Work 

The  series  of  engineering  decisions  that  normalized  technical 
deviations  shows  one  way  that  history  became  cause  in  both 
accidents.  But  NASA's  own  history  encouraged  this  pattern 
of  flying  with  known  flaws.  Seventeen  years  separated  the 
two  accidents.  NASA  Administrators,  Congresses,  and  po- 
litical administrations  changed.  However,  NASA's  political 
and  budgetary  situation  remained  the  same  in  principle  as  it 
had  been  since  the  inception  of  the  Shuttle  Program.  NASA 
remained  a  politicized  and  vulnerable  agency,  dependent  on 
key  political  players  who  accepted  NASA's  ambitious  pro- 
posals and  then  imposed  .strict  budget  limits.  Po9.t-Cluillenf;- 
er  policy  decisions  made  by  the  White  House,  Congress,  and 
NASA  leadership  resulted  in  the  agency  reproducing  many 
of  the  failings  identified  by  the  Rogers  Commission.  Policy 
constraints  affected  the  Shuttle  Program's  organization  cul- 
ture, its  structure,  and  the  structure  t)f  the  safety  system.  The 
three  combined  to  keep  NASA  on  its  slippery  slope  toward 
Challenger  and  Coliinihia.  NASA  culture  allowed  flying 
with  flaws  when  problems  were  defined  as  normal  and  rou- 
tine; the  structure  of  NASA's  Shuttle  Program  blocked  the 
flow  of  critical  information  up  the  hierarchy,  so  definitions 
of  risk  continued  unaltered.  Finally,  a  perennially  weakened 
safety  system,  unable  to  critically  analyze  and  intervene,  had 
no  choice  but  to  ratify  the  existing  risk  assessments  on  these 
two  problems.  The  following  comparison  shows  that  these 
system  effects  persisted  through  time,  and  affected  engineer- 
ing decisions  in  the  years  leading  up  to  both  accidents. 
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The  Board  found  that  dangerous  aspects  of  NASA's  1986 
culture,  identified  by  the  Rogers  Commission,  remained 
unchanged.  The  Space  Shuttle  Program  had  been  built  on 
compromises  hammered  out  by  the  White  House  and  NASA 
headquarters.''  As  a  result,  NASA  was  transformed  from  a 
research  and  development  agency  to  more  of  a  business, 
with  schedules,  production  pressures,  deadlines,  and  cost 
efficiency  goals  elevated  to  the  level  of  technical  innovation 
and  safety  goals. '^  The  Rogers  Commission  dedicated  an 
entire  chapter  of  its  report  to  production  pressures."'  More- 
over, the  Rogers  Commission,  as  well  as  the  1990  Augus- 
tine Committee  and  the  1999  Shuttle  Independent  Assess- 
ment Team,  criticized  NASA  for  treating  the  Shuttle  as  if  it 
were  an  operational  vehicle.  Launching  on  a  tight  schedule, 
which  the  agency  had  pursued  as  part  of  its  initial  bargain 
with  the  White  House,  was  not  the  way  to  operate  what 
was  in  fact  an  experimental  vehicle.  The  Board  found  that 
prior  to  Coluiiihia,  a  budget-limited  Space  Shuttle  Program, 
forced  again  and  again  to  refashion  itself  into  an  efficiency 
model  because  of  repeated  government  cutbacks,  was  beset 
by  these  same  ills.  The  harmful  effects  of  schedule  pressure 
identified  in  previous  reports  had  returned. 

Prior  to  both  accidents,  NASA  was  scrambling  to  keep  up. 
Not  only  were  schedule  pressures  impacting  the  people 
who  worked  most  closely  with  the  technology  -  techni- 
cians, mission  operators,  flight  crews,  and  vehicle  proces- 
sors -  engineering  decisions  also  were  affected.'^  For  foam 
debris  and  O-ring  erosion,  the  definition  of  risk  established 
during  the  Flight  Readiness  process  determined  actions 
taken  and  not  taken,  but  the  schedule  and  shoestring  bud- 
get were  equally  influential.  NASA  was  cutting  corners. 
Launches  proceeded  with  incomplete  engineering  work  on 
these  flaws.  Cluillenger-Qra  engineers  were  working  on  a 
permanent  fix  for  the  booster  joints  while  launches  contin- 
ued."* After  the  major  foam  bipod  hit  on  STS-1 12,  manage- 
ment made  the  deadline  for  con'ective  action  on  the  foam 
problem  after  the  next  launch,  STS-1 13,  and  then  slipped  it 
again  until  after  the  flight  of  STS-1 07.  Delays  for  flowliner 
and  Ball  Strut  Tie  Rod  Assembly  problems  left  no  margin  in 
the  schedule  between  February  2003  and  the  management- 
imposed  February  2004  launch  date  for  the  International 
Space  Station  Node  2.  Available  resources  -  including  time 
out  of  the  schedule  for  research  and  hardware  modifications 
-  went  to  the  problems  that  were  designated  as  serious  - 
those  most  likely  to  bring  down  a  Shuttle.  The  NASA 
culture  encouraged  flying  with  flaws  because  the  schedule 
could  not  be  held  up  for  routine  problems  that  were  not  de- 
fined as  a  threat  to  mission  safety."' 

The  question  the  Board  had  to  answer  was  why,  since  the 
foam  debris  anomalies  went  on  for  so  long,  had  no  one  rec- 
ognized the  trend  and  intervened?  The  O-ring  history  prior 
to  Challenfier  had  followed  the  same  pattern.  This  question 
pointed  the  Board's  attention  toward  the  NASA  organiza- 
tion structure  and  the  structure  of  its  safety  system.  Safety- 
oriented  organizations  often  build  in  checks  and  balances 
to  identify  and  monitor  signals  of  potential  danger.  If  these 
checks  and  balances  were  in  place  in  the  Shuttle  Program, 
they  weren't  working.  Again,  past  policy  decisions  pro- 
duced system  effects  with  implications  for  both  Clialleiii^er 
and  Coliniihia. 


Prior  to  Challenger,  Shuttle  Program  structure  had  hindered 
information  flows,  leading  the  Rogers  Commission  to  con- 
clude that  critical  infonnation  about  technical  problems  was 
not  conveyed  effectively  through  the  hierarchy.'"  The  Space 
Shuttle  Program  had  altered  its  structure  by  outsourcing 
to  contractors,  which  added  to  communication  problems. 
The  Commission  recommended  many  changes  to  remedy 
these  problems,  and  NASA  made  many  of  them.  However, 
the  Board  found  that  those  posl-Clialleniier  changes  were 
undone  over  time  by  management  actions.-'  NASA  ad- 
ministrators, reacting  to  govenmient  pressures,  transferred 
more  functions  and  responsibilities  to  the  private  sector. 
The  change  was  cost-efficient,  but  personnel  cuts  reduced 
oversight  of  contractors  at  the  same  time  that  the  agency's 
dependence  upon  contractor  engineering  judgment  in- 
creased. When  high-risk  technology  is  the  product  and  lives 
are  at  stake,  safety,  oversight,  and  communication  flows  are 
critical.  The  Board  found  that  the  Shuttle  Program's  normal 
chain  of  command  and  matrix  system  did  not  perform  a 
check-and-balance  function  on  either  foam  or  0-rings. 

The  Flight  Readiness  Review  process  might  have  reversed 
the  disastrous  trend  of  normalizing  O-ring  erosion  and  foam 
debris  hits,  but  it  didn't.  In  fact,  the  Rogers  Commission 
found  that  the  Flight  Readiness  process  only  affirmed  the 
\)ve.-Challenfier  engineering  risk  assessments."  Equally 
troubling,  the  Board  found  that  the  Flight  Readiness  pro- 
cess, which  is  built  on  consensus  verified  by  signatures  of 
all  responsible  parties,  in  effect  renders  no  one  accountable. 
Although  the  process  was  altered  after  Cluillenger,  these 
changes  did  not  erase  the  basic  problems  that  were  built  into 
the  structure  of  the  Flight  Readiness  Review.-'  Managers  at 
the  top  were  dependent  on  engineers  at  the  bottom  for  their 
engineering  analysis  and  risk  assessments.  Information  was 
lost  as  engineering  risk  analyses  moved  through  the  process. 
At  succeeding  stages,  management  awareness  of  anomalies, 
and  therefore  risks,  was  reduced  either  because  of  the  need 
to  be  increasingly  brief  and  concise  as  all  the  parts  of  the 
system  came  together,  or  because  of  the  need  to  produce 
consensus  decisions  at  each  level.  The  Flight  Readiness 
process  was  designed  to  assess  hardware  and  take  corrective 
actions  that  would  transfonn  known  problems  into  accept- 
able flight  risks,  and  that  is  precisely  what  it  did.  The  1986 
House  Committee  on  Science  and  Technology  concluded 
during  its  investigation  into  Challenger  that  Flight  Readi- 
ness Reviews  had  performed  exactly  as  they  were  designed, 
but  that  they  could  not  be  expected  to  replace  engineering 
analysis,  and  therefore  they  "cannot  be  expected  to  prevent 
a  flight  because  of  a  design  flaw  that  Project  management 
had  already  determined  an  acceptable  risk.""  Those  words, 
true  for  the  history  of  O-ring  erosion,  also  hold  true  for  the 
history  of  foam  debris. 

The  last  line  of  defense  against  en'ors  is  usually  a  safety 
system.  But  the  previous  policy  decisions  by  leaders  de- 
scribed in  Chapter  ."i  also  impacted  the  safety  structure 
and  contributed  to  both  accidents.  Neither  in  the  O-ring 
erosion  nor  the  foam  debris  problems  did  NASA's  safety 
system  attempt  to  reverse  the  course  of  events.  In  1986, 
the  Rogers  Commission  called  it  "The  Silent  Safety  Sys- 
tem."-' Pre-Challenger  budget  shortages  resulted  in  safety 
personnel  cutbacks.  Without  clout  or  independence,  the 
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safety  personnel  who  remained  were  ineffective.  In  the 
case  of  Coliimhia.  the  Board  found  the  same  problems 
were  reproduced  and  for  an  identical  reason:  when  pressed 
for  cost  reduction.  NASA  attacked  its  own  safety  system. 
The  faulty  assumption  that  supported  this  strategy  prior  to 
Columbia  was  that  a  reduction  in  safety  staff  would  not 
result  in  a  reduction  of  safety,  because  contractors  would 
assume  greater  safety  responsibility.  The  effectiveness 
of  those  remaining  staff  safety  engineers  was  blocked  by 
their  dependence  on  the  very  Program  they  were  charged 
to  supervise.  Also,  the  Board  found  many  safety  units  with 
unclear  roles  and  responsibilities  that  left  crucial  gaps. 
Post-Challeiiiier  NASA  still  had  no  systematic  procedure 
for  identifying  and  monitoring  trends.  The  Board  was  sur- 
prised at  how  long  it  took  NASA  to  put  together  trend  data 
in  response  to  Board  requests  for  information.  Problem 
reporting  and  tracking  systems  were  still  overloaded  or 
underused,  which  undermined  their  very  purpose.  Mul- 
tiple job  titles  disgui.sed  the  true  extent  of  safety  personnel 
shortages.  The  Board  found  cases  in  which  the  same  person 
was  occupying  more  than  one  safety  position  -  and  in  one 
instance  at  least  three  positions  -  which  compromised  any 
possibility  of  safety  organization  independence  because  the 
jobs  were  established  w  ith  built-in  conflicts  of  interest. 

8.4    Organization,  Culture,  and 
Unintended  Consequences 

A  number  of  changes  to  the  Space  Shuttle  Program  structure 
made  in  response  to  policy  decisions  had  the  unintended 
effect  of  perpetuating  dangerous  aspects  of  prc-Cluilleiii^cr 
culture  and  continued  the  pattern  of  normalizing  things  that 
were  not  supposed  to  happen.  At  the  same  time  that  NASA 
leaders  were  emphasizing  the  importance  of  safety,  their 
personnel  cutbacks  sent  other  signals.  Streamlining  and 
downsizing,  which  scarcely  go  unnoticed  by  employees, 
convey  a  message  that  efficiency  is  an  important  goal. 
The  Shuttle/Space  Station  partnership  affected  both  pro- 
grams. Working  evenings  and  weekends  just  to  meet  the 
intemational  Space  Station  Node  2  deadline  sent  a  signal 
to  employees  that  schedule  is  important.  When  paired  with 
the  "faster,  better,  cheaper"  NASA  motto  of  the  1990s  and 
cuts  that  dramatically  decreased  safety  personnel,  efficiency 
becomes  a  strong  signal  and  safety  a  weak  one.  This  kind  of 
doublespeak  by  top  administrators  affects  people's  decisions 
and  actions  without  them  even  realizing  it.-" 

Changes  in  Space  Shuttle  Program  structure  contributed  to 
the  accident  in  a  second  important  way.  Despite  the  con- 
straints that  the  agency  was  under,  prior  to  both  accidents 
NASA  appeared  to  be  immersed  in  a  culture  of  invincibility, 
in  stark  contradiction  to  post-accident  reality.  The  Rogers 
Commission  found  a  NASA  blinded  by  its  "Can-Do"  atti- 
tude,-" a  cultural  artifact  of  the  Apollo  era  that  was  inappro- 
priate in  a  Space  Shuttle  Program  so  strapped  by  schedule 
pressures  and  shortages  that  spare  parts  had  to  be  cannibal- 
ized from  one  vehicle  to  launch  another.-'*  This  can-do  atti- 
tude bolstered  administrators"  belief  in  an  achievable  launch 
rate,  the  belief  that  they  h?d  an  operational  system,  and  an 
unwillingness  to  listen  to  outside  experts.  The  Aerospace 
Safety  and  Advisory  Panel  in  a  1985  report  told  NASA 
that  the  vehicle  was  not  operational  and  NASA  should  stop 


treating  it  as  if  it  were.-' The  Board  found  that  even  after  the 
loss  of  Cluilleni>er,  NASA  was  guilty  of  treating  an  experi- 
mental vehicle  as  if  it  were  operational  and  of  not  listening 
to  outside  experts.  In  a  repeat  of  the  pre-Clialleni;er  warn- 
ing, the  1999  Shuttle  Independent  Assessment  Team  report 
reiterated  that  "the  Shuttle  was  not  an  'operational'  vehicle 
in  the  usual  meaning  of  the  tenn.'"'"  Engineers  and  program 
planners  were  also  affected  by  "Can-Do,"  which,  when 
taken  too  far,  can  create  a  reluctance  to  say  that  something 
cannot  be  done. 

How  could  the  lessons  of  Cluilleii!^er  have  been  forgotten 
so  quickly?  Again,  history  was  a  factor.  First,  if  success 
is  measured  by  launches  and  landings,"  the  machine  ap- 
peared to  be  working  successfully  prior  to  both  accidents. 
Challenger  was  the  25th  launch.  Seventeen  years  and  87 
missions  passed  without  major  incident.  Second,  previous 
policy  decisions  again  had  an  impact.  NASA's  Apollo-era 
research  and  development  culture  and  its  prized  deference 
to  the  technical  expertise  of  its  working  engineers  was 
overridden  in  the  Space  Shuttle  era  by  "bureaucratic  ac- 
countability" -  an  allegiance  to  hierarchy,  procedure,  and 
following  the  chain  of  command.*-  Prior  to  Cluilleuger.  the 
can-do  culture  was  a  result  not  just  of  years  of  apparently 
successful  launches,  but  of  the  cultural  belief  that  the  Shut- 
tle Program's  many  structures,  rigorous  procedures,  and 
detailed  system  of  rules  were  responsible  for  those  success- 
es." The  Board  noted  that  the  pK-Challeiiiier  layers  of  pro- 
cesses, boards,  and  panels  that  had  produced  a  false  sense  of 
confidence  in  the  system  and  its  level  of  safety  returned  in 
full  force  prior  to  Coliinihia.  NASA  made  many  changes  to 
the  Space  Shuttle  Program  structure  after  Challenger.  The 
fact  that  many  changes  had  been  made  supported  a  belief  in 
the  safety  of  the  system,  the  invincibility  of  organizational 
and  technical  systems,  and  ultimately,  a  sense  that  the  foam 
problem  was  understood. 

8.5    History  as  Cause:  Two  Accidents 

Risk,  uncertainty,  and  history  came  together  when  unprec- 
edented circumstances  arose  prior  to  both  accidents.  For 
Challeni^er,  the  weather  prediction  for  launch  time  the  next 
day  was  for  cold  temperatures  that  were  out  of  the  engineer- 
ing experience  base.  For  Colitnihia.  a  large  foam  hit  -  also 
outside  the  experience  base  -  was  discovered  after  launch. 
For  the  first  case,  all  the  discussion  was  pre-launch;  for 
the  second,  it  was  post-launch.  This  initial  difference  de- 
termined the  shape  these  two  decision  sequences  took,  the 
number  of  people  who  had  information  about  the  problem, 
and  the  locations  of  the  involved  parties. 

For  Challeni>er,  engineers  at  Morton-Thiokol,"  the  Solid 
Rocket  Motor  contractor  in  Utah,  were  concerned  about 
the  effect  of  the  unprecedented  cold  temperatures  on  the 
rubber  O-rings."  Because  launch  was  scheduled  for  the 
next  morning,  the  new  condition  required  a  reassessment  of 
the  engineering  analysis  presented  at  the  Flight  Readiness 
Review  two  weeks  prior.  A  teleconference  began  at  8:45 
p.m.  Eastern  Standard  Time  (EST)  that  included  34  people 
in  three  locations:  Morton-Thiokol  in  Utah.  Marshall,  and 
Kennedy.  Thiokol  engineers  were  recommending  a  launch 
delay.  A  reconsideration  of  a  Flight  Readiness  Review  risk 
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assessment  the  night  before  a  launch  was  as  unprecedented 
as  the  predicted  cold  temperatures.  With  no  ground  rules  or 
procedures  to  guide  their  discussion,  the  participants  auto- 
matically reverted  to  the  centralized,  hierarchical,  tightly 
structured,  and  procedure-bound  model  used  in  Flight  Read- 
iness Reviews.  The  entire  discussion  and  decision  to  launch 
began  and  ended  with  this  group  of  34  engineers.  The  phone 
conference  linking  them  together  concluded  at  11:15  p.m. 
EST  after  a  decision  to  accept  the  risk  and  fly. 

For  Coliiiiihia.  information  about  the  foam  debris  hit  was 
widely  distributed  the  day  after  launch.  Time  allowed  for 
videos  of  the  strike,  initial  assessments  of  the  size  and  speed 
of  the  foam,  and  the  approximate  location  of  the  impact  to 
be  dispersed  throughout  the  agency.  This  was  the  first  de- 
bris impact  of  this  magnitude.  Engineers  at  the  Marshall, 
Johnson,  Kennedy,  and  Langley  centers  showed  initiative 
and  jumped  on  the  problem  without  direction  from  above. 
Working  groups  and  e-mail  groups  formed  spontaneously. 
The  size  of  Johnson's  Debris  Assessment  Team  alone  neared 
and  in  some  instances  exceeded  the  total  number  of  partici- 
pants in  the  1986  Challeni>er  teleconference.  Rather  than  a 
tightly  constructed  exchange  of  information  completed  in  a 
few  hours,  time  allowed  for  the  development  of  ideas  and 
free-wheeling  discussion  among  the  engineering  ranks.  The 
early  post-launch  discussion  among  engineers  and  all  later 
decision-making  at  management  levels  were  decentralized, 
loosely  organized,  and  with  little  form.  While  the  spontane- 
ous and  decentralized  exchanging  of  information  was  evi- 
dence that  NASA's  original  technical  culture  was  alive  and 
well,  the  diffuse  form  and  lack  of  structm-e  in  the  rest  of  the 
proceedings  would  have  several  negative  con.sequences. 

In  both  situations,  all  new  information  was  weighed  and 
interpreted  against  past  experience.  Formal  categories  and 
cultural  beliefs  provide  a  consistent  frame  of  reference  in 
which  people  view  and  interpret  information  and  experi- 
ences.* Pre-existing  definitions  of  risk  shaped  the  actions 
taken  and  not  taken.  Worried  engineers  in  1986  and  again 
in  2003  found  it  impossible  to  reverse  the  Flight  Readiness 
Review  risk  assessments  that  foam  and  O-rings  did  not  pose 
safety-of-flight  concerns.  These  engineers  could  not  prove 
that  foam  strikes  and  cold  temperatures  were  unsafe,  even 
though  the  previous  analyses  that  declared  them  safe  had 
been  incomplete  and  were  based  on  insufficient  data  and 
testing.  Engineers'  failed  attempts  were  not  just  a  matter 
of  psychological  frames  and  interpretations.  The  obstacles 
these  engineers  faced  were  political  and  organizational. 
They  were  rooted  in  NASA  history  and  the  decisions  of 
leaders  that  had  altered  NASA  culture,  structure,  and  the 
structure  of  the  safety  system  and  affected  the  social  con- 
text of  decision-making  for  both  accidents.  In  the  following 
comparison  of  these  critical  decision  scenarios  for  Coliinihia 
and  Challenger,  the  systemic  problems  in  the  NASA  orga- 
nization are  in  italics,  with  the  system  effects  on  decision- 
making following. 

NASA  had  confUvtinf'  goals  of  cost,  schedule,  and  safety. 
Safety  lost  out  as  the  mandates  of  an  "operational  system" 
increased  the  schedule  pressure.  Scarce  resources  went  to 
problems  that  were  defined  as  more  serious,  rather  than  to 
foam  strikes  or  0-ring  erosion. 


In  both  situations,  upper-level  managers  and  engineering 
teams  working  the  O-ring  and  foam  strike  problems  held 
opposing  definitions  of  risk.  This  was  demonstrated  imme- 
diately, as  engineers  reacted  with  urgency  to  the  immediate 
safety  implications:  Thiokol  engineers  scrambled  to  put 
together  an  engineering  assessment  for  the  teleconference, 
Langley  Research  Center  engineers  initiated  simulations 
of  landings  that  were  run  after  hours  at  Ames  Research 
Center,  and  Boeing  analysts  worked  through  the  weekend 
on  the  debris  impact  analysis.  But  key  managers  were  re- 
sponding to  additional  demands  of  cost  and  schedule,  which 
competed  with  their  safety  concerns.  NASA's  conflicting 
goals  put  engineers  at  a  disadvantage  before  these  new  situ- 
ations even  aro.se.  In  neither  case  did  they  have  good  data 
as  a  basis  for  decision-making.  Because  both  problems  had 
been  previously  normalized,  resources  sufficient  for  testing 
or  hardware  were  not  dedicated.  The  Space  Shuttle  Program 
had  not  produced  good  data  on  the  correlation  betvv'een  cold 
temperature  and  O-ring  resilience  or  good  data  on  the  poten- 
tial effect  of  bipod  ramp  foam  debris  hits.'' 

Cultural  beliefs  about  the  low  risk  O-rings  and  foam  debris 
posed,  backed  by  years  of  Flight  Readiness  Review  deci- 
sions and  successful  missions,  provided  a  frame  of  refer- 
ence against  which  the  engineering  analyses  were  judged. 
When  confronted  with  the  engineering  risk  assessments,  top 
Shuttle  Program  managers  held  to  the  previous  Flight  Readi- 
ness Review  assessments.  In  the  Challenger  teleconference, 
where  engineers  were  recommending  that  NASA  delay  the 
launch,  the  Marshall  Solid  Rocket  Booster  Project  manager, 
Lawrence  Mulloy,  repeatedly  challenged  the  contractor's 
risk  assessment  and  restated  Thiokol's  engineering  ratio- 
nale for  previous  flights."*  STS-107  Mission  Management 
Team  Chair  Linda  Ham  made  many  statements  in  meetings 
reiterating  her  understanding  that  foam  was  a  maintenance 
problem  and  a  turnaround  issue,  not  a  safety-of-flight  issue. 

The  effects  of  working  as  a  manager  in  a  culture  with  a  cost/ 
efficiency/safety  conflict  showed  in  managerial  responses.  In 
both  cases,  managers'  techniques  focused  on  the  information 
that  tended  to  support  the  expected  or  desired  result  at  that 
time.  In  both  cases,  believing  the  safety  of  the  mission  was 
not  at  risk,  managers  drew  conclusions  that  minimized  the 
risk  of  delay."'  At  one  point,  Marshall's  Mulloy,  believing 
in  the  previous  Flight  Readiness  Review  assessments,  un- 
convinced by  the  engineering  analysis,  and  concerned  about 
the  schedule  implications  of  the  53-degree  temperature  limit 
on  launch  the  engineers  proposed,  said,  "My  God,  Thiokol. 
when  do  you  want  me  to  launch,  next  April?"*  Reflecting  the 
overall  goal  of  keeping  to  the  Node  2  launch  schedule.  Ham's 
priority  was  to  avoid  the  delay  of  STS-II4,  the  next  mis- 
sion after  STS-107.  Ham  was  slated  as  Manager  of  Launch 
Integration  for  STS-1 14  -  a  dual  role  promoting  a  conflict  of 
interest  and  a  single-point  failure,  a  situation  that  should  be 
avoided  in  all  organizational  as  well  as  technical  systems. 

NASA's  culture  of  bureaucratic  accountability  emphasized 
chain  of  commaiul.  procedure,  following  the  rules,  and  go- 
ing by  the  book.  While  rules  and  procedures  were  essential 
for  coordination,  they  had  an  unintended  but  negative  effect. 
Allegiance  to  hierarchy  and  procedure  had  replaced  defer- 
ence to  NASA  engineers'  technical  expertise. 
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In  both  cases,  engineers  initially  presented  concerns  as  well 
as  possible  solutions  -  a  request  for  images,  a  recommenda- 
tion to  place  temperature  constraints  on  launch.  Manage- 
ment did  not  listen  to  what  their  engineers  were  telling  them. 
Instead,  rules  and  procedures  took  priority.  For  Colnnihiu, 
program  managers  turned  off  the  Kennedy  engineers'  initial 
request  for  Department  of  Defense  imagery,  with  apologies 
to  Defense  Department  representatives  for  not  having  fol- 
lowed ""proper  channels."  In  addition,  NASA  administrators 
asked  for  and  promised  corrective  action  to  prevent  such 
a  violation  of  protocol  from  recurring.  Debris  Assessment 
Team  analysts  at  Johnson  were  asked  by  managers  to  dem- 
onstrate a  ""mandatoiy  need"  for  their  imagery  request,  but 
were  not  told  how  to  do  that.  Both  CliaUen^er  and  Coluwhia 
engineering  teams  were  held  to  the  usual  quantitative  stan- 
dard of  proof.  But  it  was  a  reverse  of  the  usual  circumstance: 
instead  of  having  to  prove  it  was  safe  to  fly,  they  were  asked 
to  prove  that  it  was  unsafe  to  fly. 

In  the  Challenger  teleconference,  a  key  engineering  chart 
presented  a  qualitative  argument  about  the  relationship  be- 
tween cold  temperatures  and  O-ring  erosion  that  engineers 
were  asked  to  prove.  Thiokol's  Roger  Boisjoly  said,  ""I  had 
no  data  to  quantify  it.  But  I  did  say  I  knew  it  was  away  from 
goodness  in  the  current  data  base."'"  Similarly,  the  Debris 
Assessment  Team  was  asked  to  prove  that  the  foam  hit  was 
a  threat  to  flight  safety,  a  determination  that  only  the  imag- 
ei'y  they  were  requesting  could  help  them  make.  Ignored  by 
management  was  the  qualitative  data  that  the  engineering 
teams  did  have:  both  instances  were  outside  the  experience 
base.  In  stark  contrast  to  the  requirement  that  engineers  ad- 
here to  protocol  and  hierarchy  was  management's  failure  to 
apply  this  criterion  to  their  own  activities.  The  Mission  Man- 
agement Team  did  not  meet  on  a  regular  schedule  during  the 
mission,  proceeded  in  a  loose  format  that  allowed  infonnal 
influence  and  status  differences  to  shape  their  decisions,  and 
allowed  unchallenged  opinions  and  assumptions  to  prevail, 
all  the  while  holding  the  engineers  who  were  making  risk 
assessments  to  higher  standards.  In  highly  uncertain  circum- 
stances, when  lives  were  immediately  at  risk,  management 
failed  to  defer  to  its  engineers  and  failed  to  recognize  that 
different  data  standards  -  qualitative,  subjective,  and  intui- 
tive -  and  different  processes  -  democratic  rather  than  proto- 
col and  chain  of  command  -  were  more  appropriate. 

The  organizational  stnutiire  and  hierarchy  blocked  effective 
communication  of  technical  problems.  Signals  were  over- 
looked, people  were  silenced,  and  useful  information  and 
dissenting  views  on  technical  issues  did  not  surface  at  higher 
levels.  What  was  comnumicated  to  parts  of  the  organization 
was  that  O-ring  erosion  and  foam  debris  were  not  problems. 

Structure  and  hierarchy  represent  power  and  status.  For  both 
Challenger  and  Columbia,  employees'  positions  in  the  orga- 
nization detennined  the  weight  given  to  their  information. 
by  their  own  judgment  and  in  the  eyes  of  others.  As  a  result, 
many  signals  of  danger  were  missed.  Relevant  information 
that  could  have  altered  the  course  of  events  was  available 
but  was  not  presented. 

Early  in  the  Challenger  teleconference,  some  engineers  who 
had  important  information  did  not  speak  up.  They  did  not 


define  themselves  as  qualified  because  of  their  position:  they 
were  not  in  an  appropriate  specialization,  had  not  recently 
worked  the  O-ring  problem,  or  did  not  have  access  to  the 
""good  data"  that  they  assumed  others  more  involved  in  key 
discussions  would  have."*-  Geographic  locations  also  re- 
sulted in  missing  signals.  At  one  point,  in  light  of  Marshall's 
objections,  Thiokol  managers  in  Utah  requested  an  '"off-line 
caucus"  to  discuss  their  data.  No  consensus  was  reached, 
so  a  "management  risk  decision"  was  made.  Managers 
voted  and  engineers  did  not.  Thiokol  managers  came  back 
on  line,  saying  they  had  reversed  their  earlier  NO-GO  rec- 
ommendation, decided  to  accept  risk,  and  would  send  new 
engineering  charts  to  back  their  reversal.  When  a  Marshall 
administrator  asked,  ""Does  anyone  have  anything  to  add  to 
this?,"  no  one  spoke.  Engineers  at  Thiokol  who  still  objected 
to  the  decision  later  testified  that  they  were  intimidated  by 
management  authority,  were  accustomed  to  turning  their 
analysis  over  to  managers  and  letting  them  decide,  and  did 
not  have  the  quantitative  data  that  would  empower  them  to 
object  further.^* 

In  the  more  decentralized  decision  process  prior  to 
Columbia's  re-entry,  structure  and  hierarchy  again  were  re- 
sponsible for  an  absence  of  signals.  The  initial  request  for 
imagery  came  from  the  "low  status"  Kennedy  Space  Center, 
bypassed  the  Mission  Management  Team,  and  went  directly 
to  the  Department  of  Defense  separate  from  the  all-power- 
ful Shuttle  Program.  By  using  the  Engineering  Directorate 
avenue  to  request  imagery,  the  Debris  Assessment  Team  was 
working  at  the  margins  of  the  hierarchy.  But  some  signals 
were  missing  even  when  engineers  traversed  the  appropriate 
channels.  The  Mission  Management  Team  Chair's  position  in 
the  hierarchy  governed  what  information  she  would  or  would 
not  receive.  Information  was  lost  as  it  traveled  up  the  hierar- 
chy. A  demoralized  Debris  Assessment  Team  did  not  include 
a  slide  about  the  need  for  better  imagery  in  their  presentation 
to  the  Mission  Evaluation  Room.  Their  presentation  included 
the  Crater  analysis,  which  they  reported  as  incomplete  and 
uncertain.  However,  the  Mission  Evaluation  Room  manager 
perceived  the  Boeing  analysis  as  rigorous  and  quantitative. 
The  choice  of  headings,  arrangement  of  information,  and  size 
of  bullets  on  the  key  chart  served  to  highlight  what  manage- 
ment already  believed.  The  uncertainties  and  assumptions 
that  signaled  danger  dropped  out  of  the  information  chain 
when  the  Mission  Evaluation  Room  manager  conden.sed  the 
Debris  Assessment  Team's  fonnal  presentation  to  an  infor- 
mal verbal  brief  at  the  Mission  Management  Team  meeting. 

As  what  the  Board  calls  an  "'informal  chain  of  command" 
began  to  shape  STS-107's  outcome,  location  in  the  struc- 
ture empowered  some  to  speak  and  silenced  others.  For 
example,  a  Thermal  Protection  System  tile  expert,  who  was 
a  member  of  the  Debris  Assessment  Team  but  had  an  office 
in  the  more  prestigious  Shuttle  Program,  used  his  personal 
network  to  shape  the  Mission  Management  Team  view  and 
snuff  out  dissent.  The  informal  hierarchy  among  and  within 
Centers  was  also  influential.  Early  identifications  of  prob- 
lems by  Marshall  and  Kennedy  may  have  contributed  to  the 
Johnson-based  Mission  Management  Team's  indifference  to 
concerns  about  the  foam  strike.  The  engineers  and  managers 
circulating  e-mails  at  Langley  were  peripheral  to  the  Shuttle 
Program,  not  stnicturally  connected  to  the  proceedings,  and 
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therefore  of  lower  status.  When  asked  hi  a  post-accident 
press  conference  why  they  didn't  voice  their  concerns  to 
Shuttle  Program  management,  the  Langley  engineers  said 
that  people  "need  to  stick  to  their  expertise."'"  Status  mat- 
tered. In  its  absence,  numbers  were  the  great  equalizer. 
One  striking  exception:  the  Debris  Assessment  Team  tile 
expert  was  so  influential  that  his  word  was  taken  as  gospel, 
though  he  lacked  the  requisite  expeilise,  data,  or  analysis 
to  evaluate  damage  to  RCC.  For  those  with  lesser  standing, 
the  requirement  for  data  was  stringent  and  inhibiting,  which 
resulted  in  information  that  warned  of  danger  not  being 
passed  up  the  chain.  As  in  the  teleconference.  Debris  As- 
sessment Team  engineers  did  not  speak  up  when  the  Mission 
Management  Team  Chair  asked  if  anyone  else  had  anything 
to  say.  Not  only  did  they  not  have  the  numbers,  they  also 
were  intimidated  by  the  Mission  Management  Team  Chair's 
position  in  the  hierarchy  and  the  conclusions  she  had  already 
made.  Debris  Assessment  Team  members  signed  off  on  the 
Crater  analysis,  even  though  they  had  trouble  understanding 
it.  They  still  wanted  images  of  Coluiiihia's  left  wing. 

In  neither  impending  crisis  did  management  recognize  how 
structure  and  hierarchy  can  silence  employees  and  follow 
through  by  polling  participants,  soliciting  dissenting  opin- 
ions, or  bringing  in  outsiders  who  might  have  a  different 
perspective  or  useful  information.  In  perhaps  the  ultimate 
example  of  engineering  concerns  not  making  their  way 
upstream.  Clialleiiiier  astronauts  were  told  that  the  cold  tem- 
perature was  not  a  problem,  and  Cohiiuhia  astronauts  were 
told  that  the  foam  strike  was  not  a  problem. 

NASA  structure  cliciiiged  as  roles  and  responsibilities  were 
transferred  to  contractors,  which  increased  the  dependence 
oil  the  private  sector  for  safety  functions  and  risk  assess- 
ment while  sinuiltaneoitsly  reducini>  the  in-hoiise  capability 
to  spot  safety  issues. 

A  critical  turning  point  in  both  decisions  hung  on  the  discus- 
sion of  contractor  risk  assessments.  Although  both  Thiokol 
and  Boeing  engineering  assessments  were  replete  with 
uncertainties.  NASA  ultimately  accepted  each.  Thiokol's 
initial  recommendation  against  the  launch  of  Challeni>er 
was  at  first  criticized  by  Marshall  as  flawed  and  unaccept- 
able. Thiokol  was  recommending  an  unheard-of  delay  on 
the  eve  of  a  launch,  with  schedule  ramifications  and  NASA- 
contractor  relationship  repercussions.  In  the  Thiokol  off-line 
caucus,  a  senior  vice  president  who  seldom  participated  in 
these  engineering  discussions  championed  the  Marshall 
engineering  rationale  for  flight.  When  he  told  the  managers 
present  to  "Take  off  your  engineering  hat  and  put  on  your 
inanagement  hat."  they  reversed  the  position  their  own 
engineers  had  taken.'*^  Marshall  engineers  then  accepted 
this  as.sessment.  deferring  to  the  expertise  of  the  contractor. 
NASA  was  dependent  on  Thiokol  for  the  risk  assessment, 
but  the  decision  process  was  affected  by  the  contractor's 
dependence  on  NASA.  Not  willing  to  be  responsible  for  a 
delay,  and  swayed  by  the  strength  of  Marshall's  argument, 
the  contractor  did  not  act  in  the  best  interests  of  safety. 
Boeing's  Crater  analysis  was  performed  in  the  context  of 
the  Debris  Assessment  Team,  which  was  a  collaborative 
effort  that  included  Johnson.  United  Space  Alliance,  and 
Boeing.  In  this  case,  the  decision  process  was  also  affected 


by  NASA's  dependence  on  the  contractor.  Unfamiliar  with 
Crater.  NASA  engineers  and  managers  had  to  rely  on  Boeing 
for  interpretation  and  analysis,  and  did  not  have  the  train- 
ing necessary  to  evaluate  the  results.  They  accepted  Boeing 
engineers'  use  of  Crater  to  model  a  debris  impact  400  times 
outside  validated  limits. 

NASA's  safety  system  lacked  the  resources,  independence, 
personnel,  and  authority  to  successfully  apply  alternate  per- 
spectives to  developing;  problems.  Overlapping^  roles  and  re- 
sponsibilities across  multiple  safety  offices  also  undermined 
the  possibility  of  a  reliable  system  of  checks  and  balances. 

NASA's  "Silent  Safety  System"  did  nothing  to  alter  the  deci- 
sion-making that  immediately  preceded  both  accidents.  No 
safety  representatives  were  present  dining  the  Challenger 
teleconference  -  no  one  even  thought  to  call  them.*  In  the 
case  of  Columbia,  safety  representatives  were  present  at 
Mission  Evaluation  Room.  Mission  Management  Team,  and 
Debris  As.sessment  Team  meetings.  However,  rather  than 
critically  question  or  actively  participate  in  the  analysis,  the 
safety  representatives  simply  listened  and  concurred. 

8.6    Changing  NASA's  Organizational 
System 

The  echoes  of  Cluilleiii^er  in  Columbia  identified  in  this 
chapter  have  serious  implications.  These  repeating  patterns 
mean  that  flawed  practices  embedded  in  NASA's  organiza- 
tional system  continued  for  20  years  and  made  substantial 
contributions  to  both  accidents.  The  Columbia  Accident 
Investigation  Board  noted  the  same  problems  as  the  Rog- 
ers Commission.  An  organization  system  failure  calls  for 
corrective  measures  that  address  all  relevant  levels  of  the 
organization,  but  the  Board's  investigation  shows  that  for  all 
its  cutting-edge  technologies,  "diving-catch"  rescues,  and 
imaginative  plans  for  the  technology  and  the  future  of  space 
exploration,  NASA  has  shown  very  little  understanding  of 
the  inner  workings  of  its  own  organization. 

NASA  managers  believed  that  the  agency  had  a  strong 
safety  culture,  but  the  Board  found  that  the  agency  had 
the  same  conflicting  goals  that  it  did  before  Challeniier. 
when  schedule  concerns,  production  pressure,  cost-cut- 
ting and  a  drive  for  ever-greater  efficiency  -  all  the  signs 
of  an  "operational"  enterprise  -  had  eroded  NASA's  abil- 
ity to  assure  mission  safety.  The  belief  in  a  safety  culture 
has  even  less  credibility  in  light  of  repeated  cuts  of  safety 
personnel  and  budgets  -  also  conditions  that  existed  before 
Challeiii^er.  NASA  managers  stated  confidently  that  every- 
one was  encouraged  to  speak  up  about  safety  issues  and  that 
the  agency  was  responsive  to  those  concerns,  but  the  Board 
found  evidence  to  the  contrary  in  the  responses  to  the  Debris 
Assessment  Team's  request  for  imagery,  to  the  initiation  of 
the  imagery  request  from  Kennedy  Space  Center,  and  to  the 
"we  were  just  'what-iffing'"  e-mail  concents  that  did  not 
reach  the  Mission  Management  Team.  NASA's  bureaucratic 
structure  kept  important  information  from  reaching  engi- 
neers and  managers  alike.  The  same  NASA  whose  engineers 
showed  initiative  and  a  solid  working  knowledge  of  how 
to  get  things  done  fast  had  a  managerial  culture  with  an  al- 
legiance to  bureaucracy  and  cost-efficiency  that  squelched 
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the  engineers'  efforts.  When  it  came  to  managers'  own  ac- 
tions, however,  a  different  set  of  rules  prevailed.  The  Board 
found  that  Mission  Management  Team  decision-making 
operated  outside  the  rules  even  as  it  held  its  engineers  to 
a  stifling  protocol.  Management  was  not  able  to  recognize 
that  in  unprecedented  conditions,  when  lives  are  on  the  line, 
flexibility  and  democratic  process  should  take  priority  over 
bureaucratic  response.'*" 

During  the  Coliiiiihiii  investigation,  the  Board  consistently 
searched  for  causal  principles  that  would  explain  both  the 
technical  and  organizational  system  failures.  These  prin- 
ciples were  needed  to  explain  Coliimhia  and  its  echoes  of 
Clialleiiiicr.  They  were  also  necessarj'  to  provide  guidance 
for  NASA.  The  Board's  analysis  of  organizational  causes  in 
Chapters  5.  6,  and  7  supports  the  following  principles  that 
should  govern  the  changes  in  the  agency's  organizational 
system.  The  Board's  specific  recommendations,  based  on 
these  principles,  are  presented  in  Part  Three. 

Lenders  create  culture.  It  is  their  responsibility  to  change 
it.  Top  administrators  must  take  responsibility  for  risk, 
failure,  and  safety  by  remaining  alert  to  the  effects  their 
decisions  have  on  the  system.  Leaders  are  responsible  for 
establishing  the  conditions  that  lead  to  their  subordinates" 
successes  or  failures.  The  past  decisions  of  national  lead- 
ers -  the  White  House.  Congress,  and  NASA  Headquarters 
-  set  the  Cohimbia  accident  in  motion  by  creating  resource 
and  schedule  strains  that  compromised  the  principles  of  a 
high-risk  technology  organization.  The  measure  of  NASA's 
success  became  how  much  costs  were  reduced  and  how  ef- 
ficiently the  schedule  was  met.  But  the  Space  Shuttle  is  not 
now.  nor  has  it  ever  been,  an  operational  vehicle.  We  cannot 
explore  space  on  a  fixed-cost  basis.  Nevertheless,  due  to 
International  Space  Station  needs  and  scientific  experiments 
that  require  particular  timing  and  orbits,  the  Space  Shuttle 
Program  seems  likely  to  continue  to  be  schedule-driven. 
National  leadership  needs  to  recognize  that  NASA  must  fly 
only  when  it  is  ready.  As  the  White  House,  Congress,  and 
NASA  Headquarters  plan  the  future  of  human  space  flight, 
the  goals  and  the  resources  required  to  achieve  them  safely 
must  be  aligned. 

Chaiiiies  in  ori'anizdtioinil  structure  should  he  made  only 
with  careful  consideration  of  their  effect  on  the  system  and 
their  possible  unintended  consequences.  Changes  that  make 
the  organization  more  complex  may  create  new  ways  that  it 
can  fail.^"  When  changes  are  put  in  place,  the  risk  of  error 
initially  increases,  as  old  ways  of  doing  things  compete  with 
new.  Institutional  memory  is  lost  as  personnel  and  records 
are  moved  and  replaced.  Changing  the  structure  of  organi- 
zations is  complicated  by  external  political  and  budgetary 
constraints,  the  inability  of  leaders  to  conceive  of  the  full 
ramifications  of  their  actions,  the  vested  interests  of  insiders, 
and  the  failure  to  learn  from  the  past.^"* 

Nonetheless,  changes  must  be  made.  The  Shuttle  Program's 
structure  is  a  source  of  problems,  not  just  because  of  the 
way  it  impedes  the  flow  of  information,  but  because  it 
has  had  effects  on  the  culture  that  contradict  safety  goals. 
NASA's  blind  spot  is  it  believes  it  has  a  strong  safety  cul- 
ture. Program  history  shows  that  the  loss  of  a  truly  indepen- 


dent, robust  capability  to  protect  the  system's  fundamental 
requirements  and  specifications  inevitably  compromised 
those  requirements,  and  therefore  increased  risk.  The 
Shuttle  Program's  structure  created  power  distributions  that 
need  new  structuring,  rules,  and  management  training  to 
restore  deference  to  technical  experts,  empower  engineers 
to  get  resources  they  need,  and  allow  safety  concerns  to  be 
freely  aired. 

Strategies  must  increase  the  clarity,  streni^th.  and  presence 
of  signed s  that  challenge  assumptions  about  risk.  Twice  in 
NASA  history,  the  agency  embarked  on  a  slippery  slope  that 
resulted  in  catastrophe.  Each  decision,  taken  by  itself,  seemed 
correct,  routine,  and  indeed,  insignificant  and  unremarkable. 
Yet  in  retrospect,  the  cumulative  effect  was  stunning.  In 
both  pre-accident  periods,  events  unfolded  over  a  long  time 
and  in  small  increments  rather  than  in  sudden  and  dramatic 
occurrences.  NASA's  challenge  is  to  design  systems  that 
maximize  the  clarity  of  signals,  amplify  weak  signals  so  they 
can  be  tracked,  and  accoimt  for  missing  signals.  For  both  ac- 
cidents there  were  moments  when  management  definitions 
of  risk  might  have  been  reversed  were  it  not  for  the  many 
missing  signals  -  an  absence  of  trend  analysis,  imagery  data 
not  obtained,  concerns  not  voiced,  information  overlooked 
or  dropped  from  briefings.  A  safety  team  must  have  equal 
and  independent  representation  so  that  managers  are  not 
again  lulled  into  complacency  by  shifting  definitions  of  risk. 
It  is  obvious  but  worth  acknowledging  that  people  who  are 
marginal  and  powerless  in  organizations  may  have  useful 
infoiTTiation  or  opinions  that  they  don't  express.  Even  when 
these  people  are  encouraged  to  speak,  they  find  it  intimidat- 
ing to  contradict  a  leader's  strategy  or  a  group  consensus. 
Extra  effort  must  be  made  to  contribute  all  relevant  informa- 
tion to  discussions  of  risk.  These  strategies  are  important  for 
all  safety  aspects,  but  especially  necessary  for  ill-structured 
problems  like  O-rings  and  foam  debris.  Because  ill-structured 
problems  are  less  visible  and  therefore  invite  the  normaliza- 
tion of  deviance,  they  may  be  the  most  risky  of  all. 


Challenger  launches  on  the  ill-fafeci  STS-33/51  -L  mission  on  Janu- 
ary 28,  1986.  The  Orbiter  would  be  destroyed  73  seconds  later. 
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Part  Three 


A  Look  Ahead 


When  it 's  dark,  the  stars  come  out . . .  The  same  is  true 
with  people.  When  the  tragedies  of  life  turn  a  bright  day 
into  a  frightening  night.  God's  stars  come  out  and  these 
stars  are  families  who  say  although  we  grieve  deeply 
as  do  the  families  of  Apollo  1  and  Challenger  before 
us,  the  bold  exploration  of  space  must  go  on.  These 
stars  are  the  leaders  in  Government  and  in  NASA  who 
will  not  let  the  visi(m  die.  These  stars  are  the  next  gen- 
eration of  astronauts,  who  like  the  prophets  of  old  said, 
"Here  am  I,  send  me. " 

-  Brig.  Gen.  Charles  Baldwin.  STS-I(I7  Memorial 
Ceremony  at  the  National  Cathedral.  February  6,  2003 


As  this  report  ends,  the  Board  wants  to  recognize  the  out- 
standing people  in  NASA.  We  have  been  impressed  with 
their  diligence,  commitment,  and  professionalism  as  the 
agency  has  been  working  tirelessly  to  help  the  Board  com- 
plete this  report.  While  mistakes  did  lead  to  the  accident,  and 
we  found  that  organizational  and  cultural  constraints  have 
worked  against  safety  margins,  the  NASA  family  should 
nonetheless  continue  to  take  great  pride  in  their  legacy  and 
ongoing  accomplishments.  As  we  look  ahead,  the  Board  sin- 
cerely hopes  this  report  will  aid  NASA  in  safely  getting  back 
to  human  space  flight. 

In  Part  Three  the  Board  presents  its  views  and  recommenda- 
tions for  the  steps  needed  to  achieve  that  goal,  of  continuing 
our  exploration  of  space,  in  a  manner  with  improved  safety. 

Chapter  9  discusses  the  near-term,  mid-term  and  long-term 
implications  for  the  future  of  human  space  flight.  For  the 
near  term,  NASA  should  submit  to  the  Relurn-to-Flight  Task 
Force  a  plan  for  implementing  the  return-to-flight  recom- 
mendations. For  the  mid-terin,  the  agency  should  focus  on: 
the  remaining  Part  One  recommendations,  the  Part  Two  rec- 
ommendations for  organizational  and  cultural  changes,  and 
the  Part  Three  recommendation  for  recertifying  the  Shuttle 
for  use  to  2020  or  bcvf)nd.  In  setting  the  stasze  for  a  debate 


on  the  long-term  future  of  human  space  flight,  the  Board  ad- 
dresses the  need  for  a  national  vision  to  direct  the  design  of 
a  new  Space  Transportation  System. 

Chapter  10  contains  additional  recommendations  and  the 
significant  "look  ahead"  observations  the  Board  made  in  the 
course  of  this  investigation  that  were  not  directly  related  to 
the  accident,  but  could  be  viewed  as  "weak  signals"  of  fu- 
ture problems.  The  observations  may  be  indications  of  seri- 
ous future  problems  and  must  be  addressed  by  NASA. 

Chapter  1 1  contains  the  recommendations  made  in  Parts 
One,  Two  and  Three,  all  issued  with  the  resolve  to  continue 
human  space  flight. 
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Columbia  in  the  Vehicle  Assembly  Building  at  the  Kennedy  Space  Cenfer  being  readied  for  STS-107  in  lafe  2002. 
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Chapter  9 


Implications  for  the 
Future  of  Human  Space  Flight 


And  while  many  memorials  will  he  built  to  honor  Co- 
lumbia 'v  crew,  their  greatest  memorial  will  he  a  vibrant 
space  program  with  new  missions  carried  out  by  a  new 
generation  of  brave  explorers. 

Remarks  by   Vice  President  Richard  B.  Ciicncy,  Memorial 
Ceremony  al  the  National  Cathedral.  Februarv  6.  2003 


The  report  up  to  this  point  has  been  a  look  backward:  a  single 
accident  with  multiple  causes,  both  physical  and  organiza- 
tional. In  this  chapter,  the  Board  looks  to  the  future.  We  take 
the  insights  gained  in  investigating  the  loss  of  Columbia  and 
her  crew  and  seek  to  apply  them  to  this  nation's  continu- 
ing journey  into  space.  We  divide  our  discussion  into  three 
timeframes:  I )  short-term.  NASA's  return  to  flight  after  the 
Columbia  accident;  2)  mid-term,  what  is  needed  to  continue 
flying  the  Shuttle  fleet  until  a  replacement  means  for  human 
access  to  space  and  for  other  Shuttle  capabilities  is  available: 
and  3)  long-term,  future  directions  for  the  U.S.  in  space.  The 
objective  in  each  case  is  for  this  country  to  maintain  a  human 
presence  in  space,  but  with  enhanced  safety  of  flight. 

In  this  report  we  have  documented  numerous  indications 
that  NASA's  safety  performance  has  been  lacking.  But  even 
correcting  all  those  shortcomings,  it  should  be  understood, 
will  not  eliminate  risk.  All  flight  entails  some  measure  of 
risk,  and  this  has  been  the  case  since  before  the  days  of  the 
Wright  Brothers.  Furthermore,  the  risk  is  not  distributed 
evenly  over  the  course  of  the  flight.  It  is  greater  by  far  at  the 
beginning  and  end  than  during  the  middle. 

This  concentration  of  risk  at  the  endpoints  of  flight  is  particu- 
larly true  for  crew-carrying  space  missions.  The  Shuttle  Pro- 
gram has  now  suffered  two  accidents,  one  just  over  a  minute 
after  takeoff  and  the  other  about  16  minutes  before  landing. 
The  laws  of  physics  make  it  extraordinarily  difhcult  to  reach 
Earth  orbit  and  return  safely.  Using  existing  technology,  or- 
bital flight  is  accomplished  only  by  harnessing  a  chemical 
reaction  that  converts  vast  amounts  of  stored  energy  into 


speed.  There  is  great  risk  in  placing  human  beings  atop  a 
machine  that  stores  and  then  burns  millions  of  pounds  of 
dangerous  propellants.  Fx|ually  risky  is  having  humans  then 
ride  the  machine  back  to  Earth  while  it  dissipates  the  orbital 
speed  by  c(Miverting  the  energy  into  heat,  much  like  a  meteor 
entering  Earth's  atmosphere.  No  alternatives  to  this  pathway 
to  space  are  available  or  even  on  the  horizon,  so  we  must 
set  our  sights  on  managing  this  risky  process  using  the  inost 
advanced  and  versatile  techniques  at  our  disposal. 


Columbia  launches  as  STS107  on  January  16,  2003. 
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Because  of  the  dangers  of  ascent  and  re-entry,  because  of 
the  hostility  of  the  space  environment,  and  because  we 
are  still  relative  newcomers  to  this  realm,  operation  of  the 
Shuttle  and  indeed  all  human  spaceflight  must  be  viewed 
as  a  developmental  activity.  It  is  still  far  from  a  routine, 
operational  undertaking.  Throughout  the  Columbia  accident 
investigation,  the  Board  has  commented  on  the  widespread 
but  erroneous  perception  of  the  Space  Shuttle  as  somehow 
comparable  to  civil  or  military  air  transport.  They  are  not 
comparable;  the  inherent  risks  of  spaceflight  are  vastly  high- 
er, and  our  experience  level  with  spaceflight  is  vastly  lower. 
if  Shuttle  operations  came  to  be  viewed  as  routine,  it  was,  at 
least  in  part,  thanks  to  the  skill  and  dedication  of  those  in- 
volved in  the  program.  They  have  made  it  look  easy,  though 
in  fact  it  never  was.  The  Board  urges  NASA  leadership,  the 
architects  of  U.S.  space  policy,  and  the  American  people  to 
adopt  a  realistic  understanding  of  the  risks  and  rewards  of 
venturing  into  space. 

9.1     Near-Term:  Return  to  Flight 

The  Board  supports  return  to  flight  for  the  Space  Shuttle  at 
the  earliest  date  consistent  with  an  overriding  consideration: 
safety.  The  recognition  of  human  spaceflight  as  a  develop- 
mental activity  requires  a  shift  in  focus  from  operations  and 
meeting  schedules  to  a  concern  for  the  risks  involved.  Nec- 
essary measures  include: 

•  Identifying  risks  by  looking  relentlessly  for  the  next 
eroding  O-ring.  the  next  falling  foam;  obtaining  better 
data,  analyzing  and  spotting  trends. 

•  Mitigating  risks  by  stopping  the  failure  at  its  source: 
when  a  failure  does  occur,  improving  the  ability  to  tol- 
erate it;  repairing  the  damage  on  a  timely  basis. 

•  Decoupling  unforeseen  events  from  the  loss  of  crew  and 
vehicle. 

•  Exploring  all  options  for  survival,  such  as  provisions  for 
crew  escape  systems  and  safe  havens. 

•  Barring  unwarranted  departures  froin  design  standards, 
and  adjusting  standards  only  under  the  most  rigorous, 
safety-driven  process. 

The  Board  has  recommended  improvements  that  are  needed 
before  the  Shuttle  Program  returns  to  flight,  as  well  as  other 
measures  to  be  adopted  over  the  longer  term  -  what  might  be 
considered  "continuing  to  fly"  recommendations.  To  ensure 
implementation  of  these  longer-term  recommendations,  the 
Board  makes  the  following  recommendation,  which  should 
be  included  in  the  requirements  for  retum-to-flight: 

R9. 1  - 1  Prepare  a  detailed  plan  for  defining,  establishing, 
transitioning,  and  implementing  an  independent 
Technical  Engineering  Authority,  independent 
safety  program,  and  a  reorganized  Space  Shuttle 
Integration  Office  as  described  in  R7.5-I,  R7.3- 
2,  and  R7.5-3.  In  addition,  NASA  should  submit 
annual  reports  to  Congress,  as  part  of  the  budget 
review  process,  on  its  implementation  activi- 
ties. 

The  complete  list  of  the  Board's  recommendations  can  be 
found  in  Chapter  1 1. 


9.2    Mid-Term:  Continuing  to  Fly 

It  is  the  view  of  the  Board  that  the  present  Shuttle  is  not 
inherently  unsafe.  However,  the  observations  and  recom- 
mendations in  this  report  are  needed  to  make  the  vehicle 
safe  enough  to  operate  in  the  coming  years.  In  order  to  con- 
tinue operating  the  Shuttle  for  another  decade  or  even  more, 
which  the  Human  Space  Flight  Program  may  find  necessary, 
these  significant  measures  must  be  taken: 

•  Implement  all  the  recommendations  listed  in  Part  One 
of  this  report  that  were  not  already  accomplished  as  part 
of  the  retum-to-flight  reforms. 

•  Institute  all  the  organizational  and  cultural  changes 
called  for  in  Part  Two  of  this  report. 

•  Undertake  complete  recertification  of  the  Shuttle,  as 
detailed  in  the  discussion  and  recommendation  below. 

The  urgency  of  these  recommendations  derives,  at  least  in 
part,  from  the  likely  pattern  of  what  is  to  come.  In  the  near 
term,  the  recent  memory  of  the  Coliimhia  accident  will  mo- 
tivate the  entire  NASA  organization  to  scrupulous  attention 
to  detail  and  vigorous  efforts  to  resolve  elusive  technical 
problems.  That  energy  will  inevitably  dissipate  over  time. 
This  decline  in  vigilance  is  a  characteristic  of  many  large 
organizations,  and  it  has  been  demonstrated  in  NASA's  own 
history.  As  reported  in  Part  Two  of  this  report,  the  Human 
Space  Flight  Program  has  at  times  compromised  safety  be- 
cause of  its  organizational  problems  and  cultural  traits.  That 
is  the  reason,  in  order  to  prevent  the  return  of  bad  habits  over 
time,  that  the  Board  makes  the  recommendations  in  Part 
Two  calling  for  changes  in  the  organization  and  culture  of 
the  Human  Space  Flight  Program.  These  changes  will  take 
more  time  and  effort  than  would  be  reasonable  to  expect 
prior  to  return  to  flight. 

Through  its  recoinmendations  in  Part  Two.  the  Board  has 
urged  that  NASA's  Human  Space  Flight  Program  adopt  the 
characteristics  observed  in  high-reliability  organizations. 
One  is  separating  technical  authority  from  the  functions  of 
managing  schedules  and  cost.  Another  is  an  independent 
Safety  and  Mission  Assurance  organization.  The  third  is  the 
capability  for  effective  systems  integration.  Perhaps  even 
more  challenging  than  these  organizational  changes  are  the 
cultural  changes  required.  Within  NASA,  the  cultural  im- 
pediments to  safe  and  effective  Shuttle  operations  are  real 
and  substantial,  as  documented  extensively  in  this  report. 
The  Board's  view  is  that  cultural  problems  are  unlikely  to 
be  corrected  without  top-level  leadership.  Such  leadership 
will  have  to  rid  the  system  of  practices  and  patterns  that 
have  been  validated  simply  because  they  have  been  around 
so  long.  Examples  include:  the  tendency  to  keep  knowledge 
of  problems  contained  within  a  Center  or  program;  making 
technical  decisions  without  in-depth,  peer-reviewed  techni- 
cal analysis;  and  an  unofficial  hierarchy  or  caste  system  cre- 
ated by  placing  excessive  power  in  one  office.  Such  factors 
interfere  with  open  communication,  impede  the  sharing  of 
lessons  learned,  cause  duplication  and  unnecessary  expen- 
diture of  resources,  prompt  resistance  to  external  advice, 
and  create  a  burden  for  managers,  among  other  undesirable 
outcomes.  Collectively,  these  undesirable  characteristics 
threaten  safety. 


z  o  s 


Report    Voli 


iT     2  0  0  3 


COLUMBIA 

ACCIDENT  INVESTIGATION  fiDARD 


Unlike  retum-to-flight  recommendations,  the  Board's  man- 
agement and  cultural  recommendations  will  take  longer 
to  implement,  and  the  responses  must  be  tine-tuned  and 
adjusted  during  implementation.  The  question  of  how  to  fol- 
low up  on  NASA's  implementation  of  these  more  subtle,  but 
equally  important  recommendations  remains  unanswered. 
The  Board  is  aware  that  response  to  these  recommenda- 
tions will  be  difficult  to  initiate,  and  they  will  encounter 
some  degree  of  institutional  resistance.  Nevertheless,  in  the 
Board's  view,  they  are  so  critical  to  safer  operation  of  the 
Shuttle  fleet  that  they  must  be  carried  out  completely.  Since 
NASA  is  an  independent  agency  answerable  only  to  the 
White  House  and  Congress,  the  ultimate  responsibility  for 
enforcement  of  the  recommended  corrective  actions  must 
reside  with  those  governmental  authorities. 

Recertification 

Recertification  is  a  process  to  ensure  flight  safety  when  a 
vehicle's  actual  utilization  exceeds  its  original  design  life; 
such  a  baseline  examination  is  essential  to  certify  that  ve- 
hicle for  continued  use.  in  the  case  of  the  Shuttle  to  2020 
and  possibly  beyond.  This  report  addresses  recertification  as 
a  mid-term  issue. 

Measured  by  their  20  or  more  missions  per  Orbiter,  the 
Shuttle  fleet  is  young,  but  by  chronological  age  -  10  to  20 
years  each  -  it  is  old.  The  Board's  discovery  of  mass  loss  in 
RCC  panels,  the  deferral  of  investigation  into  signs  of  metal 
corrosion,  and  the  deferral  of  upgrades  all  strongly  suggest 
that  a  policy  is  needed  requiring  a  complete  recertification 
of  the  Space  Shuttle.  This  recertification  must  be  rigorous 
and  comprehensive  at  every  level  (i.e..  material,  compo- 
nent, subsystem,  and  system);  the  higher  the  level,  the  more 
critical  the  integration  of  lower-level  components.  A  post- 
Challeni^er.  10-year  review  was  conducted,  but  it  lacked  this 
kind  of  rigor,  comprehensiveness  and,  most  importantly,  in- 
tegration at  the  subsystem  and  system  levels. 

Aviation  industry  standards  offer  ample  measurable  criteria 
for  gauging  specific  aging  characteristics,  such  as  stress  and 
corrosion.  The  Shuttle  Program,  by  contrast,  lacks  a  closed- 
loop  feedback  system  and  consequently  does  not  take  full 
advantage  of  all  available  data  to  adjust  its  certification  pro- 
cess and  maintenance  practices.  Data  sources  can  include 
experience  with  material  and  component  failures,  non-con- 
formances  (deviations  from  original  specifications)  discov- 
ered during  Orbiter  .Vlaintenance  Down  Periods,  Analytical 
Condition  Inspections,  and  Aging  Aircraft  studies.  Several 
of  the  recommendations  in  this  report  constitute  the  basis  for 
a  recertification  program  (such  as  the  call  for  nondestrtictive 
evaluation  of  RCC  components).  Chapters  .^  and  4  cite  in- 
stances of  waivers  and  certification  of  components  for  flight 
based  on  analysis  rather  than  testing.  The  recertification 
program  should  correct  all  those  deficiencies. 

Finally,  recertification  is  but  one  aspect  of  a  Service  Life  Ex- 
tension Program  that  is  essential  if  the  Shuttle  is  to  continue 
operating  for  another  10  to  20  years.  While  NASA  has  such 
a  program,  it  is  in  its  infancy  and  needs  to  be  pursued  with 
vigor.  The  Service  Life  Extension  Program  goes  beyond  the 
Shuttle  itself  and  addresses  critical  associated  components 


in  equipment,  infrastructure,  and  other  areas.  Aspects  of  the 
program  are  addressed  in  Appendix  D.  1 5. 

The  Board  makes  the  following  recommendation  regarding 
recertification: 

R9.2-1  Prior  to  operating  the  Shuttle  beyond  2010, 
develop  and  conduct  a  vehicle  recertification  at 
the  material,  ctimponent,  subsystem,  and  system 
levels.  Recertification  requirements  should  be 
included  in  the  Service  Life  Extension  Program. 

9.3    Long-Term:  Future  Directions  for  the 
U.S.  in  Space 

The  Board  in  its  investigation  has  focused  on  the  physical 
and  organizational  causes  of  the  Columbia  accident  and  the 
recommended  actions  required  for  future  safe  Shuttle  opera- 
tion. In  the  course  of  that  investigation,  however,  two  reali- 
ties affecting  those  recommendations  have  become  evident 
to  the  Board.  One  is  the  lack,  over  the  past  three  decades, 
of  any  national  mandate  providing  NASA  a  compelling 
mission  requiring  human  presence  in  space.  President  John 
Kennedy's  1961  charge  to  send  Americans  to  the  moon  and 
return  them  safely  to  Earth  "before  this  decade  is  out"  linked 
NASA's  efforts  to  core  Cold  War  national  interests.  Since 
the  1970s,  NASA  has  not  been  charged  with  carrying  out  a 
similar  high  priority  mission  that  would  justify  the  expendi- 
ture of  resources  on  a  scale  equivalent  to  those  allocated  for 
Project  Apollo.  The  result  is  the  agency  has  found  it  neces- 
sary to  gain  the  support  of  diverse  constituencies.  NASA  has 
had  to  participate  in  the  give  and  take  of  the  normal  political 
process  in  order  to  obtain  the  resources  needed  to  carry  out 
its  programs.  NASA  has  usually  failed  to  receive  budgetary 
support  consistent  with  its  ambitions.  The  result,  as  noted 
throughout  Part  Two  of  the  report,  is  an  organization  strain- 
ing to  do  too  much  with  too  little. 

A  second  reality,  following  from  the  lack  of  a  clearly  defined 
long-term  space  mission,  is  the  lack  of  sustained  government 
commitment  over  the  past  decade  to  improving  U.S.  access 
to  space  by  developing  a  second-generation  space  transpor- 
tation system.  Without  a  compelling  reason  to  do  so,  succes- 
sive Administrations  and  Congresses  have  not  been  willing 
to  commit  the  billions  of  dollars  required  to  develop  such  a 
vehicle.  In  addition,  the  space  community  has  proposed  to 
the  government  the  development  of  vehicles  such  as  the  Na- 
tional Aerospace  Plane  and  X-33,  which  required  "leapfrog" 
advances  in  technology;  those  advances  have  proven  to  be 
unachievable.  As  Apollo  1 1  Astronaut  Buzz  Aldrin,  one  of 
the  members  of  the  recent  Commission  on  the  Future  of  the 
United  States  Aerospace  Industry,  commented  in  the  Com- 
mission's November  2002  report,  "Attempts  at  developing 
breakthrough  space  transportation  systems  have  proved  il- 
lusory."' The  Board  believes  that  the  country  should  plan 
for  future  space  transportation  capabilities  without  making 
them  dependent  on  technological  breakthroughs. 

Lack  of  a  National  Vision  for  Space 

In  1969  President  Richard  Ni.xon  rejected  NASA's  sweeping 
vision  for  a  post-Apollo  effort  that  involved  full  develop- 
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ment  of  low-Earth  orbit,  permanent  outposts  on  the  moon, 
and  initial  journeys  to  Mars.  Since  that  rejection,  these  objec- 
tives have  reappeared  as  central  elements  in  many  proposals 
setting  forth  a  long-term  vision  for  the  U.S.  Space  program. 
In  1986  the  National  Commission  on  Space  proposed  "a 
pioneering  mission  for  21st-century  America:  To  lead  the 
exploration  and  development  of  the  space  frontier,  advanc- 
ing science,  technology,  and  enterprise,  and  building  institu- 
tions and  systems  that  make  accessible  vast  new  resources 
and  support  human  settlements  beyond  Earth  orbit,  from  the 
highlands  of  the  Moon  to  the  plains  of  Mars."-  In  1 989,  on  the 
20th  anniversary  of  the  first  lunar  landing.  President  George 
H.W.  Bush  proposed  a  Space  Exploration  Initiative,  calling 
for  "a  sustained  program  of  manned  exploration  of  the  solar 
system."'  Space  advocates  have  been  consistent  in  their  call 
for  sending  humans  beyond  low-Earth  orbit  as  the  appropri- 
ate objective  of  U.S.  space  activities.  Review  committees  as 
diverse  as  the  1990  Advisoiy  Committee  on  the  Future  of 
the  U.S.  Space  Program,  chaired  by  Norman  Augustine,  and 
the  2001  International  Space  Station  Management  and  Cost 
Evaluation  Task  Force  have  suggested  that  the  primary  justi- 
fication for  a  space  station  is  to  conduct  the  research  required 
to  plan  missions  to  Mars  and/or  other  distant  destinations. 
However, , human  travel  to  destinations  beyond  Earth  orbit 
has  not  been  adopted  as  a  national  objective. 

The  report  of  the  Augustine  Committee  commented,  "It 
seems  that  most  Americans  do  support  a  viable  space  pro- 
gram for  the  nation  -  but  no  two  individuals  seem  able  to 
agree  upon  what  that  space  program  should  be."'' The  Board 
observes  that  none  of  the  competing  long-term  visions  for 
space  have  found  support  from  the  nation's  leadership,  or 
indeed  among  the  general  public.  The  U.S.  civilian  space 
effort  has  moved  forward  for  more  than  30  years  without  a 
guiding  vision,  and  none  seems  imminent.  In  the  past,  this 
absence  of  a  strategic  vision  in  itself  has  reflected  a  policy 
decision,  since  there  have  been  many  opportunities  for  na- 
tional 'leaders  to  agree  on  ambitious  goals  for  space,  and 
none  have  done  so. 

The  Board  does  observe  that  there  is  one  area  of  agreement 
among  almost  all  parties  interested  in  the  future  of  U.S.  ac- 
tivities in  space:  The  United  States  needs  improved  access  for 
Inimans  to  low-Earth  orbit  as  a  foundation  for  whatever  di- 
rections the  nation  '.v  space  proi^rani  takes  in  the  future.  In  the 
Board's  view,  a  full  national  debate  on  how  best  to  achieve 
such  improved  access  should  take  place  in  parallel  with  the 
steps  the  Board  has  recommended  for  returning  the  Space 
Shuttle  to  flight  and  for  keeping  it  operating  safely  in  coming 
years.  Recommending  the  content  of  this  debate  goes  well 
beyond  the  Board's  mandate,  but  we  believe  that  the  White 
House,  Congress,  and  NASA  should  honor  the  memory  of 
Cohinihia\  crew  by  reflecting  on  the  nation's  future  in  space 
and  the  role  of  new  space  transportation  capabilities  in  en- 
abling whatever  space  goals  the  nation  chooses  to  pursue. 

All  members  of  the  Board  agree  that  America's  future  space 
efforts  must  include  human  presence  in  Earth  orbit,  and 
eventually  beyond,  as  outlined  in  the  current  NASA  vision. 
Recognizing  the  absence  of  an  agreed  national  mandate 
cited  above,  the  current  NASA  strategic  plan  stresses  an 
approach  of  investing  in  "transfonnational  technologies" 


that  will  enable  the  development  of  capabilities  to  serve  as 
"stepping  stones"  for  whatever  path  the  nation  may  decide  it 
wants  to  pursue  in  space.  While  the  Board  has  not  reviewed 
this  plan  in  depth,  this  approach  seems  prudent.  Absent  any 
long-term  statement  of  what  the  country  wants  to  accom- 
plish in  space,  it  is  difficult  to  state  with  any  specificity  the 
requirements  that  should  guide  major  public  investments  in 
new  capabilities.  The  Board  does  believe  that  NASA  and 
the  nation  should  give  more  attention  to  developing  a  new 
"concept  of  operations"  for  future  activities  -  defining  the 
range  of  activities  the  country  intends  to  carry  out  in  space 
-  that  could  provide  more  specificity  than  currently  exists. 
Such  a  concept  does  not  necessarily  require  full  agreement 
on  a  future  vision,  but  it  should  help  identify  the  capabilities 
required  and  prevent  the  debate  from  focusing  solely  on  the 
design  of  the  next  vehicle. 

Developing  a  New  Space  Transportation  System 

When  the  Space  Shuttle  development  was  approved  in 
1972.  there  was  a  corresponding  decision  not  to  fund  tech- 
nologies for  space  transportation  other  than  those  related 
to  the  Shuttle.  This  decision  guided  policy  for  more  than 
20  years,  until  the  National  Space  Transportation  Policy  of 
1994  assigned  NASA  the  role  of  developing  a  next-genera- 
tion, advanced-technology,  single-stage-to-orbit  replace- 
ment for  the  Space  Shuttle.  That  decision  was  flawed  for 
several  reasons.  Because  the  United  States  had  not  funded 
a  broad  portfolio  of  space  transportation  technologies  for 
the  preceding  three  decades,  there  was  a  limited  technology 
base  on  which  to  base  the  choice  of  this  second-generation 
system.  The  technologies  chosen  for  development  in  1996, 
which  were  embodied  in  the  X-33  demonstrator,  proved 
not  yet  mature  enough  for  use.  Attracted  by  the  notion  of 
a  growing  private  sector  market  for  space  transportation, 
the  Clinton  Administration  hoped  this  new  system  could  be 
developed  with  minimal  public  investment  -  the  hope  was 
that  the  private  sector  would  help  pay  for  the  development 
of  a  Shuttle  replacement. 

In  recent  years  there  has  been  increasing  investment  in 
space  transportation  technologies,  particularly  through 
NASA's  Space  Launch  Initiative  effort,  begun  in  2000.  This 
investment  has  not  yet  created  a  technology  base  for  a  sec- 
ond-generation reusable  system  for  carrying  people  to  orbit. 
Accordingly,  in  2002  NASA  decided  to  reorient  the  Space 
Launch  Initiative  to  longer-term  objectives,  and  to  introduce 
the  concept  of  an  Orbital  Space  Plane  as  an  interim  comple- 
ment to  the  Space  Shuttle  for  space  station  crew-candying  re- 
sponsibilities. The  Integrated  Space  Transportation  Plan  also 
called  for  using  the  Space  Shuttle  for  an  extended  period 
into  the  future.  The  Board  has  evaluated  neither  NASA's  In- 
tegrated Space  Transportation  Plan  nor  the  detailed  require- 
ments of  an  Orbital  Space  Plane. 

Even  so,  based  on  its  in-depth  examination  of  the  Space 
Shuttle  Program,  the  Board  has  reached  an  inescapable 
conclusion:  Because  of  the  risks  inherent  in  the  orii^inal 
design  of  the  Space  Shuttle,  because  that  desii^n  was  based 
in  many  aspects  on  now-obsolete  technologies,  and  because 
the  Shuttle  is  now  an  «.!,'/';,!,'  system  but  still  developnwntal  in 
character,  it  is  in  the  nation's  interest  to  replace  the  Shuttle 
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as  soon  as  possible  as  the  primary  means  for  transportini^ 
humans  To  and  from  Earth  orbit.  At  least  in  the  mid-term, 
that  replacement  will  be  some  form  of  what  NASA  now 
characterizes  as  an  Orbital  Space  Plane.  The  design  of  the 
system  should  give  overriding  priority  to  crew  safety,  rather 
than  trade  safety  against  other  performance  criteria,  such  as 
low  cost  and  reusability,  or  against  advanced  space  opera- 
tion capabilities  other  than  crew  transfer. 

This  conclusion  implies  that  whatever  design  NASA  chooses 
should  become  the  primai^  means  for  taking  people  to  and 
from  the  International  Space  Station,  not  just  a  complement 
to  the  Space  Shuttle.  And  it  follows  from  the  same  conclusion 
that  there  is  urgency  in  choosing  that  design,  after  serious 
review  of  a  "concept  of  operations"  for  human  space  flight, 
and  bringing  it  into  operation  as  soon  as  possible.  This  is 
likely  to  require  a  significant  commitment  of  resources  over 
the  next  several  years.  The  nation  must  not  shy  from  making 
that  commitment.  The  International  Space  Station  is  likely 
to  be  the  major  destination  for  human  space  travel  for  the 
next  decade  or  longer.  The  Space  Shuttle  would  continue  to 
be  used  when  its  unique  capabilities  are  required,  both  with 
respect  to  space  station  missions  such  as  experiment  deliveiy 
and  retrieval  or  other  logistical  missions,  and  with  respect  to 
the  few  planned  missions  not  traveling  to  the  space  station. 
When  cargo  can  be  carried  to  the  space  station  or  other  desti- 
nations by  an  expendable  launch  vehicle,  it  should  be. 

However,  the  Orbital  Space  Plane  is  seen  by  NASA  as  an 
interim  system  for  transporting  humans  to  orbit.  NASA  plans 
to  make  continuing  investments  in  "next  generation  launch 
technology,"  with  the  hope  that  those  investments  will  en- 
able a  decision  by  the  end  of  this  decade  on  what  that  next 
generation  launch  vehicle  should  be.  This  is  a  worthy  goal, 
and  should  be  pursued.  The  Board  notes  that  this  approach 
can  only  be  successful:  if  it  is  sustained  over  the  decade:  if  by 
the  time  a  decision  to  develop  a  new  vehicle  is  made  there  is 
a  clearer  idea  of  how  the  new  space  transportation  system  fits 
into  the  nation's  overall  plans  for  space:  and  if  the  U.S.  i^ov- 
ernment  is  willini>  at  the  time  a  development  decision  is  made 
to  commit  the  suhsfcmticd  resources  required  to  implement  it. 
One  of  the  major  problems  with  the  way  the  Space  Shuttle 
Program  was  carried  out  was  an  a  priori  fixed  ceiling  on  de- 
velopment costs.  That  approach  should  not  be  repeated. 

It  is  the  view  of  the  Board  that  the  previous  attempts  to  de- 
velop a  replacement  vehicle  for  the  a^inf;  Shuttle  represent 
a  failure  of  national  leadership.  The  cause  of  the  failure 
was  continuing  to  expect  major  technological  advances  in 
that  vehicle.  With  the  amount  of  risk  inherent  in  the  Space 
Shuttle,  the  first  step  should  be  to  reach  an  agreement  that 
the  overriding  mission  of  the  replacement  system  is  to  move 
humans  safely  and  reliably  into  and  out  of  Earth  orbit.  To 
demand  more  would  be  to  fall  into  the  same  trap  as  all  previ- 
ous, unsuccessful,  efforts.  That  being  said,  it  seems  to  the 
Board  that  past  and  future  investments  in  space  launch  tech- 
nologies should  certainly  provide  by  2010  or  thereabouts  the 
basis  for  developing  a  system,  significantly  improved  over 
one  designed  40  years  earlier,  for  carrying  humans  to  orbit 
and  enabling  their  work  in  space.  Continued  U.S.  leadership 
in  space  is  an  important  national  objective.  That  leadership 
depends  on  a  willingness  to  pay  the  costs  of  achieving  it. 


Final  Conclusions 

The  Board's  perspective  assumes,  of  course,  that  the  United 
States  wants  to  retain  a  continuing  capability  to  send  people 
into  space,  whether  to  Earth  orbit  or  beyond.  The  Board's 
work  over  the  past  seven  months  has  been  motivated  by 
the  desire  to  honor  the  STS-107  crew  by  understanding 
the  cause  of  the  accident  in  which  they  died,  and  to  help 
the  United  States  and  indeed  all  spacefaring  countries  to 
minimize  the  risks  of  future  loss  of  lives  in  the  exploration 
of  space.  The  United  States  should  continue  with  a  Human 
Space  Flight  Program  consistent  with  the  resolve  voiced  by 
President  George  W.  Bush  on  February  1,  2003:  "Mankind 
is  led  into  the  darkness  beyond  our  world  by  the  inspiration 
of  discovery  and  the  loni^iui^  to  understand.  Our  journey  into 
space  will  i>o  on." 


Two  proposals  -  a  capsule  (above)  and  a  winged  vehicle  -  for  the 
Orbital  Space  Plane,  courtesy  of  The  Boeing  Company. 
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Endnotes  for  Chapter  9 
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CTF  followed  by  seven  to  eleven  digits,  such  as  CABOOl-0010,  refer  to  a 
document  in  the  Columbia  Accident  Investigation  Board  database  maintained 
by  the  Department  of  Justice  and  archived  at  the  National  Archives. 
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Other 
Significant  Observations 


Although  the  Board  now  understands  the  combination  of 
technical  and  organizational  factors  that  contributed  to  the 
ColiimhUi  accident,  the  investigation  did  not  immediately 
zero  in  on  the  causes  identified  in  previous  chapters.  Instead, 
the  Board  explored  a  number  of  avenues  and  topics  that,  in 
the  end,  were  not  directly  related  to  the  cause  of  this  ac- 
cident. Nonetheless,  these  forays  revealed  technical,  safety, 
and  cultural  issues  that  could  impact  the  Space  Shuttle  Pro- 
gram, and,  more  broadly,  the  future  of  human  space  flight. 
The  significant  issues  listed  in  this  chapter  are  potentially 
serious  matters  that  should  be  addresed  by  NASA  becau.se 
they  fall  into  the  category  of  "'weak  signals"  that  could  be 
indications  of  future  problems. 

10.1  Public  Safety 

Shortly  after  the  breakup  of  Coltinihia  over  Texas,  dramatic 
images  of  the  Orbiter's  debris  surfaced:  an  intact  spherical 
tank  in  an  empty  parking  lot,  an  obliterated  office  rooftop, 
mangled  metal  along  roadsides,  charred  chunks  of  material 
in  fields.  These  images,  combined  with  the  large  number  of 
debris  fragments  that  were  recovered,  compelled  many  to 
proclaim  it  was  a  ""miracle"  that  no  one  on  the  ground  had 
been  hurt.' 

The  Columbia  accident  raises  some  important  questions 
about  public  safety.  What  were  the  chances  that  the  general 
public  could  have  been  hurt  by  a  breakup  of  an  Orbiter? 
How  safe  are  Shuttle  flights  compared  with  those  of  con- 
ventional aircraft?  How  much  public  risk  from  space  flight 
is  acceptable?  Who  is  responsible  for  public  safety  during 
space  flight  operations? 

Public  Risk  from  Columbia's  Breakup 

The  Board  commissioned  a  study  to  determine  if  the  lack  of 
reported  injuries  on  the  ground  was  a  predictable  outcome  or 
simply  exceptionally  good  fortune  (see  Appendix  D.  1 6).  The 
study  extrapolated  from  an  array  of  data,  including  census 
figures  for  the  debris  impact  area,  the  Orbiter's  last  reported 


position  and  velocity,  the  impact  locations  (latitude  and  lon- 
gitude), and  the  total  weight  t)f  all  recovered  debris,  as  well 
as  the  composition  and  dimensions  of  many  debris  pieces.- 

Based  on  the  best  available  evidence  on  C()liinihia\  disinte- 
gration and  ground  impact,  the  lack  of  serious  injuries  on  the 
ground  was  the  expected  outcome  for  the  location  and  time 
at  which  the  breakup  occuired.' 

NASA  and  others  have  developed  sophisticated  computer 
tools  to  predict  the  trajectory  and  survivability  of  spacecraft 
debris  during  re-entry.^  Such  tools  have  been  used  to  assess 
the  risk  of  serious  injuries  to  the  public  due  to  spacecraft 
re-entry,  including  debris  impacts  from  launch  vehicle 
malfunctions.''  However,  it  is  impossible  to  be  certain  about 
what  fraction  of  Coliinihia  survived  to  impact  the  ground. 
Some  38  percent  of  Coliiiiihia's,  dry  (empty)  weight  was 
recovered,  but  there  is  no  way  to  determine  how  much  still 
lies  on  the  ground.  Accounting  for  the  inherent  uncertainties 
associated  with  the  amount  of  ground  debris  and  the  num- 
ber of  people  outdoors,''  there  was  about  a  9-  to  24-percent 
chance  of  at  least  one  person  being  seriously  injured  by  the 
disintegration  of  the  Orbiter." 

Debris  fell  on  a  relatively  sparsely  populated  area  of  the 
United  States,  with  an  average  of  about  8.5  inhabitants  per 
square  mile.  Orbiter  re-entry  flight  paths  often  pass  over 
much  more  populated  areas,  including  major  cities  that 
average  more  than  1 ,000  inhabitants  per  square  mile.  For 
example,  the  STS-107  re-enti^y  profile  passed  over  Sac- 
ramento, California,  and  Albuquerque.  New  Mexico.  The 
Board-sponsored  study  concluded  that,  given  the  unlikely 
event  of  a  similar  Orbiter  breakup  over  a  densely  populated 
area  such  as  Houston,  the  most  likely  outcome  would  be  one 
or  two  ground  casualties. 

Space  Flight  Risk  Compared  to  Aircraft  Operations 

A  recent  study  of  U.S.  civil  aviation  accidents  found  that 
between  1964  and  1999,  falling  aircraft  debris  killed  an  av- 
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erage  of  eight  people  per  year.**  In  comparison,  the  National 
Center  for  Health  Statistics  reports  that  between  1992  and 
1994,  an  average  of  65  people  in  the  United  States  were 
killed  each  year  by  lightning  strikes.  The  aviation  accident 
study  revealed  a  decreasing  trend  in  the  annual  number  of 
"groundling"  fatalities,  so  that  an  average  of  about  four 
fatalities  per  year  are  predicted  in  the  near  future.'*  The  prob- 
ability of  a  U.S.  resident  being  killed  by  aircraft  debris  is 
now  less  than  one  in  a  million  over  a  70-year  lifetime.'" 

The  history  of  U.S.  space  flight  has  a  flawless  public  safety 
record.  Since  the  1950s,  there  have  been  hundreds  of  U.S. 
space  launches  without  a  single  member  of  the  public  being 
injured.  Comparisons  between  the  risk  to  the  public  from 
space  flight  and  aviation  operations  are  limited  by  two  fac- 
tors; the  absence  of  public  injuries  resulting  from  U.S.  space 
flight  operations,  and  the  relatively  small  number  of  space 
flights  (hundreds)  compared  to  aircraft  flights  (billions)." 
Nonetheless,  it  is  unlikely  that  U.S.  space  flights  will  pro- 
duce many,  if  any,  public  injuries  in  the  coming  years  based 
on  ( 1 )  the  low  numberof  space  flight  operations  per  year,  (2) 
the  flawless  public  safety  record  of  past  U.S.  space  launches, 

(3)  government-adopted  space  flight  safety  standards,'-  and 

(4)  the  risk  assessment  result  that,  even  in  the  unlikely  event 
of  a  similar  Orbiter  breakup  over  a  major  city,  less  than  two 
ground  casualties  would  be  expected.  In  short,  the  risk  posed 
to  people  on  the  ground  by  U.S.  space  flight  operations  is 
small  compared  to  the  risk  from  civil  aircraft  operations. 

The  government  has  sought  to  limit  public  risk  from  space 
flight  to  levels  comparable  to  the  risk  produced  by  aircraft. 
U.S.  space  launch  range  commanders  have  agreed  that  the 
public  should  face  no  more  than  a  one-in-a-million  chance 
of  fatality  from  launch  vehicle  and  unmanned  aircraft  op- 
erations." This  aligns  with  Federal  Aviation  Administration 
(FAA)  regulations  that  individuals  be  exposed  to  no  more 
than  a  one-in-a-million  chance  of  serious  injury  due  to  com- 
mercial space  launch  and  re-entry  operations.'^ 

NASA  has  not  actively  followed  public  ri.sk  acceptability 
standards  used  by  other  government  agencies  during  past 
Orbiter  re-entry  operations.  However,  in  the  aftermath  of  the 
Columbia  accident,  the  agency  has  attempted  to  adopt  similar 
rules  to  protect  the  public.  It  has  also  developed  computer 
tools  to  predict  the  sui-vivability  of  spacecraft  debris  during 
re-entry.  Such  tools  have  been  used  to  assess  the  risk  of  public 
casualties  attributable  to  spacecraft  re-entry,  including  debris 
impacts  from  commercial  launch  vehicle  malfunctions.'^ 

Responsibility  for  Public  Safety 

The  Director  of  the  Kennedy  Space  Center  is  responsible 
for  the  ground  and  flight  safety  of  Kennedy  Space  Center 
people  and  property  for  all  launches."'  The  Air  Force  pro- 
vides the  Director  with  written  notification  of  launch  area 
risk  estimates  for  Shuttle  ascents.  The  Air  Force  routinely 
computes  the  risk  that  Shuttle  ascents'^  pose  to  people  on 
and  off  Kennedy  grounds  from  potential  debris  impacts, 
toxic  exposures,  and  explosions."* 

However,  no  equivalent  collaboration  exists  between  NASA 
and  the  Air  Force  for  re-entry  risk.  FAA  rules  on  commercial 


space  launch  activities  do  not  apply  "where  the  Government 
is  so  substantially  involved  that  it  is  effectively  directing  or 
controlling  the  launch."  Based  on  the  lack  of  a  response,  in 
tandem  with  NASA's  public  statements  and  informal  replies 
to  Board  questions,  the  Board  determined  that  NASA  made 
no  documented  effort  to  assess  public  risk  from  Orbiter  re- 
entry operations  prior  to  the  Coliiinhia  accident.  The  Board 
believes  that  NASA  should  be  legally  responsible  for  public 
safety  during  all  phases  of  Shuttle  operations,  including  re- 
entry'. 

Findings: 

F 1 0. 1  - 1  The  Columbia  accident  demonstrated  that  Orbiter 
breakup  during  re-entry  has  the  potential  to  cause 
casualties  among  the  general  public. 

FIO.  1-2  Given  the  best  information  available  to  date, 
a  formal  risk  analysis  sponsored  by  the  Board 
found  that  the  lack  of  general-public  casualties 
from  Columbia's  break-up  was  the  expected  out- 
come. 

FIO.  1-3  The  history  of  U.S.  space  flight  has  a  flawless 
public  safety  record.  Since  the  1950s,  hundreds 
of  space  flights  have  occurred  without  a  single 
public  injury. 

FIO.  I  -4  The  FAA  and  U.S.  space  launch  ranges  have  safe- 
ty standards  designed  to  ensure  that  the  general 
public  is  exposed  to  less  than  a  one-in-a-million 
chance  of  serious  injury  from  the  operation  of 
space  launch  vehicles  and  unmanned  aircraft. 

FIO.  1-5  NASA  did  not  demonstrably  follow  public  risk 
acceptability  standards  during  past  Orbiter  re- 
entries. NASA  efforts  are  underway  to  define  a 
national  policy  for  the  protection  of  public  safety 
during  all  operations  involving  space  launch  ve- 
hicles. 

Observations: 

OIO.I-I  NASA  should  develop  and  implement  a  public 
risk  acceptability  policy  for  launch  and  re-entry 
of  space  vehicles  and  unmanned  aircraft. 

0 10. 1-2  NASA  should  develop  and  implement  a  plan  to 
mitigate  the  risk  that  Shuttle  flights  pose  to  the 
general  public. 

Ol 0.1-3  NASA  should  study  the  debris  recovered  from 
Columbia  to  facilitate  realistic  estimates  of  the 
risk  to  the  public  during  Orbiter  re-entry. 


10.2  Crew  Escape  and  Survival 

The  Board  has  examined  crew  escape  systems  in  historical 
context  with  a  view  to  future  improvements.  It  is  important 
to  note  at  the  outset  that  Columbia  broke  up  during  a  phase 
of  flight  that,  given  the  current  design  of  the  Orbiter.  offered 
no  possibility  of  crew  survival. 

The  goal  of  evei7  Shuttle  mission  is  the  safe  return  of  the 
crew.  An  escape  system— a  means  for  the  crew  to  leave  a 
vehicle  in  distress  during  some  or  all  of  its  flight  phases 
and  return  safely  to  Earth  -  has  historically  been  viewed 
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as  one  "technique"  to  accomplish  that  end.  Other  methods 
include  various  abort  modes,  rescue,  and  the  creation  of  a 
safe  haven  (a  location  where  crew  members  could  remain 
unharmed  if  they  are  unable  to  return  to  Earth  aboard  a  dam- 
aged Shuttle). 

While  crew  escape  systems  have  been  discussed  and  stud- 
ied continuously  since  the  Shuttle's  early  design  phases, 
only  two  systems  have  been  incorporated:  one  for  the  de- 
velopmental test  flights,  and  the  current  system  installed 
after  the  Cluillc'ni;er  accident.  Both  designs  have  extremely 
limited  capabilities,  and  neither  has  ever  been  used  during 
a  mission. 

Developmental  Test  Flights 

Early  studies  assumed  that  the  Space  Shuttle  would  be  op- 
erational in  every  sense  of  the  word.  As  a  result,  much  like 
commercial  airliners,  a  Shuttle  crew  escape  system  was  con- 
sidered unnecessary.  NASA  adopted  requirements  for  rapid 
emergency  egress  of  the  crew  in  early  Shuttle  test  flights. 
Modified  SR-71  ejection  seats  for  the  two  pilot  positions 
were  installed  on  the  Orbiter  test  vehicle  Enterprise,  which 
was  carried  to  an  altitude  of  25.000  feet  by  a  Boeing  747 
Shuttle  Carrier  Aircraft  during  the  Approach  and  Landing 
Tests  in  1977.''' 

Essentially  the  same  system  was  installed  on  Coliiinhici  and 
used  for  the  four  Orbital  Test  Flights  during  1981-82.  While 
this  system  was  designed  for  use  during  first-stage  ascent 
and  in  gliding  flight  below  100.000  feet,  considerable  doubt 
emerged  about  the  survivability  of  an  ejection  that  would 
expose  crew  members  to  the  .Solid  Rocket  Booster  exhaust 
plume.  Regardless,  NASA  declared  the  developmental  test 
flight  phase  complete  after  STS-4,  Coliinihia's  fourth  flight, 
and  the  ejection  seat  system  was  deactivated.  Its  as.sociated 
hardware  was  removed  during  modification  after  STS-9.  All 
Space  Shuttle  missions  after  STS-4  were  conducted  with 
crews  of  four  or  more,  and  no  escape  system  was  installed 
until  after  the  loss  of  Cluilleni;er  in  1986. 

Before  the  CluiUeni>er  accident,  the  question  of  crew  sur- 
vival was  not  considered  independently  from  the  possibility 
of  catastrophic  Shuttle  damage.  In  short,  NASA  believed  if 
the  Orbiter  could  be  saved,  then  the  crew  would  be  safe.  Per- 
ceived limits  of  the  use  of  escape  systems,  along  with  their 
cost,  engineering  complexity,  and  weight/payload  trade- 
offs, dissuaded  NASA  from  implementing  a  crew  escape 
plan.  Instead,  the  agency  focused  on  preventing  the  loss  of  a 
Shuttle  as  the  sole  means  for  assuring  crew  survival. 

Post-C/ia//enger:  the  Current  System 

NASA's  rejection  of  a  crew  escape  system  was  severely 
criticized  after  the  loss  of  Challeiiiier.  The  Rogers  Commis- 
sion addressed  the  topic  in  a  recommendation  that  combined 
the  issues  of  launch  abort  and  crew  escape:-" 

Ldiineh  Abort  anil  Crew  Escape.  The  Shuttle  Pr(>f>raiii 
manafiement  considered  first-staf;e  abort  options  and 
crew  escape  options  .several  times  diirini>  the  history 
of  the  prof>ram.  hitt  because  of  limited  utility,  technical 


infeasibility,  or  prof^ram  cost  and  .schedule,  no  systems 
were  implemeii'ed.  The  Commission  recommends  that 
NASA: 

•  Make  all  efforts  to  provide  a  crew  escape  .system  for 
use  during  controlled  gliding  flight. 

•  Make  every  effort  to  increase  the  range  of  flight 
conditions  under  which  an  emergency  runway  land- 
ing can  be  succes.sfully  condiuted  in  the  event  that 
two  or  three  main  engines  fail  early  in  a.scent. 

In  response  to  this  recommendation,  NASA  developed  the 
current  "pole  bailout"  system  for  use  during  controlled,  sub- 
sonic gliding  flight  (see  Figure  10.2-1 ).  The  system  requires 
crew  members  to  "vent"  the  cabin  at  40.000  feet  (to  equalize 
the  cabin  pressure  with  the  pressure  at  that  altitude),  jettison 
the  hatch  at  approximately  32,000  feet,  and  then  jump  out  of 
the  vehicle  (the  pole  allows  crew  members  to  avoid  striking 
the  Orbiter's  wings). 


Figure  70.2-7.  A  demonstration  of  the  pole  bailout  system.  The 
pole  is  extending  from  the  side  of  a  C-141  simulating  the  Orbiter, 
with  a  crew  member  sliding  down  the  pole  so  that  he  would  fall 
clear  of  the  Orbiter's  wing  during  an  actual  bailout. 


Current  Human-Rating  Requirements 

In  June  1998,  Johnson  Space  Center  issued  new  Human- 
Rating  Requirements  applicable  to  "all  future  human-rated 
spacecraft  operated  by  NASA."  In  July  2003,  shortly  before 
this  report  was  published,  NASA  issued  further  Human-Rat- 
ing Requirements  and  Guidelines  for  Space  Flight  Systems, 
over  the  signature  of  the  Associate  Administrator  for  Safety 
and  Mission  Assurance.  While  these  new  requirements  "... 
shall  not  supersede  more  stringent  requirements  imposed  by 
individual  NASA  organizations  ..."  NASA  has  infonned  the 
Board  that  the  earlier  -  and  in  some  cases  more  prescriptive 
-  Johnson  Space  Center  requirements  have  been  cancelled. 
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NASA's  2003  Human-Rating  Requirements  and  Guidelines 
for  Space  Flight  Systems  laid  out  the  following  principles 
regarding  crew  escape  and  survival: 

2.5.4  Crew  .siin'ival 

2.5.4.1  As  part  of  the  ilesiiiii  process.  pn>:j^rain 
nuiiuii^einent  (with  approval  from  the 
CHMO  [Chief  Health  and  Medical  Offi- 
cer], AAfor  OSF  [Associate  Administrator 
for  the  Office  of  Spaceflight  |,  and  AAfor 
SMA  [Associate  Administrator  for  Safety 
and  Mission  Assurance]  shall  establish, 
assess,  and  document  the  program  re- 
quirements for  an  acceptable  life  cycle 
cumulative  prohabilit}'  of  safe  crew  and 
passenger  return.  This  probability  require- 
ment can  be  satisfied  through  the  use  of  all 
available  mechanisms  including  nomincd 
mission  completion,  abort,  safe  haven,  or 
crew  escape. 

2.5.4.2  The  cumulative  probability  of  safe  crew 
and  passenger  return  shall  address  all 
missions  planned  for  the  life  of  the  pro- 
gram, not  just  a  single  space  flight  system 
for  a  single  mission. 

The  overall  probability  of  crew  and  passenger  survival  must 
meet  the  minimum  program  requirements  (as  defined  in 
section  2.5.4.1 )  for  the  stated  life  of  a  space  flight  systems 
program.-'  This  approach  is  required  to  reflect  the  different 
technical  challenges  and  levels  of  operational  risk  exposure 
on  various  types  t)f  missions.  For  example,  low-Earth-orbit 
missions  represent  fundamentally  different  risks  than  does 
the  first  mission  to  Mars.  Single-mission  risk  on  the  order 
of  0.9^  for  a  beyond-Earth-orbit  mission  may  be  acceptable, 
but  considerably  better  performance,  on  the  order  of  0.9999, 
is  expected  for  a  reusable  low-Earth-orbit  design  that  will 
make  100  or  more  flights. 

2.6  Abort  and  Crew  Escape 

2.6.1  The  capability  for  rapid  crew  and  occu- 
pant egress  shall  be  provided  dufi'tg  (ill 
pre-laimch  activities. 

2.6.2  The  capability  for  crew  and  occupant 
siu-vival  and  recover}'  shall  be  provided  on 
ascent  using  a  combination  of  abort  and 
escape. 

2.6.3  The  capability  for  crew  and  occupant 
survival  and  recovery  shall  be  provided 
during  all  other  phases  of  flight  (includ- 
ing on-orhit,  reentry,  and  landing)  using 
a  combination  of  abort  and  escape,  un- 
less comprehensive  .safety  and  reliability 
analyses  indicate  that  abort  and  escape 
capability  is  not  required  to  meet  crew 
survival  requirenwnts. 


2.6.4  Determinations    regarding    escape    and 

abort  shall  be  made  based  upon  compre- 
hensive .safety  and  reliabUity  analyses 
across  all  mission  profiles. 

These  new  requirements  focus  on  general  crew  survival 
rather  than  on  particular  crew  escape  systems.  This  provides 
a  logical  context  for  discussions  of  tradeoffs  that  will  yield 
the  best  crew-survival  outcome.  Such  tradeoffs  include 
"mass-trades"  -  for  example,  an  escape  system  could 
add  weight  to  a  vehicle,  but  in  the  process  cause  payload 
changes  that  require  additional  missions,  thereby  inherently 
increasing  the  overall  exposure  to  risk. 

Note  that  the  new  requirements  for  crew  escape  appear  less 
prescriptive  than  Johnson  Space  Center  Requirement  7, 
which  deals  with  "safe  crew  extraction"  from  pre-launch  to 
landing. -- 

In  addition,  the  extent  to  which  NASA's  2003  requirements 
will  retroactively  apply  to  the  Space  Shuttle  is  an  open  ques- 
tion: 

The  Governing  Program  Management  Council  (GPMC) 
will  determine  the  applicability  of  this  document  to  pro- 
grams and  projects  in  existence  (e.g.,  heritage  expend- 
able and  reusable  launch  vehicles  and  evolved  expend- 
able launch  vehicles),  at  or  beyond  implementation,  at 
the  time  of  the  issuance  of  this  document. 

Recommendations  of  the  NASA  Aerospace  Safety 
Advisory  Panel 

The  issue  of  crew  escape  has  long  been  a  matter  of  con- 
cern to  NASA's  Aerospace  Safety  Advisory'  Panel.  In  its 
2002  Annual  Repoil,  the  panel  noted  that  NASA  Program 
Guidelines  on  Human  Rating  require  escape  systems  for  all 
flight  vehicles,  but  the  guidelines  do  not  apply  to  the  Space 
Shuttle.  The  Panel  considered  it  appropriate,  in  view  of  the 
Shuttle's  proposed  life  extension,  to  consider  upgrading  the 
vehicle  to  comply  with  the  guidelines.-' 

Recommendation  02-9:  Complete  the  ongoing  .studies 
of  crew  escape  design  options.  Either  document  the  rea- 
sons for  twt  implementing  the  NASA  Program  Guide- 
lines on  Human  Rating  or  expedite  the  deployment  of 
such  capabilities. 

The  Board  shares  the  concern  of  the  NASA  Aerospace 
Safety  Advisory  Panel  and  others  over  the  lack  of  a  crew  es- 
cape system  for  the  Space  Shuttle  that  could  cover  the  wid- 
est possible  range  of  flight  regimes  and  emergencies.  At  the 
same  time,  a  crew  escape  system  is  just  one  element  to  be 
optimized  for  crew  survival.  Crucial  tradeoffs  in  risk,  com- 
plexity, weight,  and  operational  utility  must  be  made  when 
considering  a  Shuttle  escape  system.  Designs  for  future  ve- 
hicles and  possible  retrofits  should  be  evaluated  in  this  con- 
text. The  sole  objective  must  be  the  highest  probability  of  a 
crew's  safe  return  regardless  if  that  is  due  to  successful  mis- 
sion completions,  vehicle-intact  aborts,  safe  haven/rescues, 
escape  systems,  or  some  combination  of  these  scenarios. 
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Finally,  a  crew  escape  system  cannot  be  considered  sepa- 
rately from  the  issues  of  Shuttle  retirement/replacement, 
separation  of  cargo  from  crew  in  future  vehicles,  and  other 
considerations  in  the  development  -  and  the  inherent  risks 
of  space  flight. 

Space  flight  is  an  inherently  dangerous  undertaking,  and  will 
remain  so  for  the  foreseeable  future.  While  all  efforts  must 
be  taken  to  minimize  its  risks,  the  White  House,  Congress, 
and  the  American  public  must  acknowledge  these  dangers 
and  be  prepared  to  accept  their  consequences. 

Observations: 

OI0.2-1  Future  crewed-vehicle  requirements  should  in- 
coiporate  the  knowledge  gained  from  the  Clicil- 
leiii>er  and  Cnluinbiu  accidents  in  assessing  the 
feasibility  of  vehicles  that  could  ensure  crew 
survival  even  if  the  vehicle  is  destroyed. 

10.3  Shuhle  Engineering  Drawings  and 
Closeout  Photographs 

In  the  years  since  the  Shuttle  was  designed,  NASA  has  not 
updated  its  engineering  drawings  or  converted  to  computer- 
aided  drafting  systems.  The  Board's  review  of  these  engi- 
neering drawings  revealed  numerous  inaccuracies.  In  par- 
ticular, the  drawings  do  not  incorporate  many  engineering 
changes  made  in  the  last  two  decades.  Equally  troubling  was 
the  difficulty  in  obtaining  these  drawings:  it  took  up  to  four 
weeks  to  receive  them,  and,  though  some  photographs  were 
available  as  a  short-term  substitute,  closeout  photos  took  up 
to  six  weeks  to  obtain.  (Closeout  photos  are  pictures  taken 
of  Shuttle  areas  before  they  are  sealed  off  for  flight.)  The 
Aerospace  Safety  Advisory  Panel  noted  similar  difficulties 
in  its  2001  and  2002  reports. 

The  Board  believes  that  the  Shuttle's  current  engineer- 
ing drawing  system  is  inadequate  for  another  20  years" 
use.  Widespread  inaccuracies,  unincorporated  engineering 
updates,  and  significant  delays  in  this  system  represent  a 
significant  dilemma  for  NASA  in  the  event  of  an  on-orbit 
crisis  that  requires  timely  and  accurate  engineering  informa- 
tion. The  dangers  of  an  inaccurate  and  inaccessible  draw- 
ing system  are  exacerbated  by  the  apparent  lack  of  readily 
available  closeout  photographs  as  interim  replacements  (see 
Appendix  D.  15). 

Findings: 

FIO.3-1  The  engineering  drawing  system  contains  out- 
dated information  and  is  paper-based  rather  than 
computer-aided. 

FIO.3-2  The  current  drawing  system  cannot  quickly 
portray  Shuttle  sub-systems  for  on-orbit  trouble- 
shooting. 

FIO.3-3  NASA  normally  uses  closeout  photographs  but 
lacks  a  clear  system  to  define  which  critical 
sub-systems  should  have  such  photographs.  The 
current  system  does  not  allow  the  immediate  re- 
trieval of  closeout  photos. 


Recommendations: 

R  10.3-1  Develop  an  interim  program  of  closeout  pho- 
tographs for  all  critical  sub-systems  that  differ 
froiTi  engineering  drawings.  Digitize  the  close- 
out photograph  system  so  that  images  are  imme- 
diately available  for  on-orbit  troubleshooting. 

R  10.3-2  Provide  adequate  resources  for  a  long-term  pro- 
gram to  upgrade  the  Shuttle  engineering  drawing 
system  including: 

•  Reviewing  drawings  for  accuracy 

•  Converting  all   drawings  to  a  computer- 
aided  drafting  system 

•  Incorporating  engineering  changes 

10.4  Industrial  Safety  and  Quality  Assurance 

The  industrial  safety  programs  in  place  at  NASA  and  its 
contractors  are  robust  and  in  good  health.  However,  the 
scope  and  depth  of  NASA's  maintenance  and  quality  as- 
surance programs  are  troublesome.  Though  unrelated  to  the 
Coliiiiihia  accident,  the  major  deficiencies  in  these  programs 
uncovered  by  the  Board  could  potentially  contribute  to  a 
future  accident. 

Industrial  Safety 

Industrial  safety  programs  at  NASA  and  its  contractors- 
covering  safety  measures  "on  the  shop  floor"  and  in  the 
workplace  -  were  examined  by  interviews,  observations,  and 
reviews.  Vibrant  industrial  safety  programs  were  found  in  ev- 
ery area  examined,  reflecting  a  common  interview  comment: 
"If  anything,  we  go  overboard  on  safety."  Industrial  safety 
programs  are  highly  visible:  they  are  nearly  always  a  topic 
of  work  center  meetings  and  are  represented  by  numerous 
safety  campaigns  and  posters  (see  Figure  10.4-1 ). 


Figure  10.4-1,  Safety  posters  at  NASA  and  contractor  facilities. 
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Initiatives  like  Michoiid's  "This  is  Stupid"  program  and 
the  United  Space  Alliance's  "Time  Out"  cards  empower 
employees  to  halt  any  operation  under  way  if  they  believe 
industrial  safety  is  being  compromised  (see  Figure  10.4-2). 
For  example,  the  Time  Out  program  encourages  and  even 
rewards  workers  who  report  suspected  safety  problems  to 
management. 


ASSERTIVE 
STATEMENT 


OPENING 

Gel  persons  attention 

CONCERN 

Slate  level  ot  concern 
Uneasy'^Very  wofned'' 

PROBLEM 

Slate  the  problem,  realoi 
perceived 

SOLUTION 

State  your  suggested 
solution,  if  you  have  one 

AGREEMENT 

Assertively  respectfully 
ask  for  their  response  For 
example  What  do  you 
Ihink'^  Don't  you  agree'' 

When  all  else  fails,  use  "THIS  IS  STUPID'"'  to 
aien  PIC  and  olfiers  to  potential  for  incident. 
injufv.  Of  accident 

TIME 

m 

EVERY  EMPLOYEE 

HAS  THE  RIGHT 

TO  CALL  A  TIME  OUT 


Figure  10.4-2.  The  "This  is  Stupid"  card  from  fhe  Michoud  Assem- 
bly Facility  and  the  "Time  Out"  card  from  United  Space  Alliance. 


NASA  similarly  maintains  the  Safety  Reporting  System, 
which  creates  lines  of  communication  through  which  anon- 
ymous inputs  are  forwarded  directly  to  headquarters  (see 
Figure  10.4-3).  The  NASA  Shuttle  Logistics  Depot  focus  on 
safety  has  been  recognized  as  an  Occupational  Safety  and 
Health  Administration  Star  Site  for  its  participation  in  the 
Voluntary  Protection  Program.  After  the  Shuttle  Logistics 
Depot  was  recertified  in  2002,  employees  worked  more  than 
750  days  without  a  lost-time  mishap. 

Quality  Assurance 

Quality  Assurance  programs  -  encompassing  steps  to  en- 
courage error-free  work,  as  well  as  inspections  and  assess- 
ments of  that  work  -  have  evolved  considerably  in  scope 
over  the  past  five  years,  transitioning  from  intensive,  com- 
prehensive inspection  regimens  to  much  smaller  programs 
based  on  past  risk  analysis. 

As  described  in  Part  Two,  after  the  Space  Flight  Operations 
Contract  was  established,  NASA's  quality  assurance  role 
at  Kennedy  Space  Center  was  significantly  reduced.  In  the 
course  of  this  transition.  Kennedy  reduced  its  inspections 
-  called  Government  Mandatory  Inspection  Points  -  by 
more  than  80  percent.  Marshall  Space  Flight  Center  cut  its 
inspection  workload  from  49,000  government  inspection 
points  and  82 1 ,000  contractor  inspections  in  1990  to  1 3.700 
and  461,000,  respectively,  in  2002.  Similar  cutbacks  were 
made  at  most  NASA  centers. 

Inspection  requirements  are  specified  in  the  Quality  Planning 
Requirements  Document  (also  called  the  Mandatoi^  inspec- 


tions Document).  United  Space  Alliance  technicians  must 
document  an  estimated  730,000  tasks  to  complete  a  single 
Shuttle  maintenance  flow  at  Kennedy  Space  Center.  Nearly 
every  task  assessed  as  Critical ity  Code  1 ,  I R  (redundant),  or 
2  is  always  inspected,  as  are  any  systems  not  verifiable  by  op- 
erational checks  or  tests  prior  to  final  preparations  for  flight. 

Nearly  everyone  interviewed  at  Kennedy  indicated  that  the 
current  inspection  process  is  both  inadequate  and  difficult 
to  expand,  even  incrementally.  One  example  was  a  long- 
standing request  to  add  a  main  engine  final  review  before 
transporting  the  engine  to  the  Orbiter  Processing  Facility  for 
installation.  This  request  was  first  voiced  two  years  before 
the  launch  of  STS-107,  and  has  been  repeatedly  denied  due 
to  inadequate  staffing.  In  its  place,  NASA  Mission  Assur- 
ance conducts  a  final  "informal"  review.  Adjusting  govern- 
ment inspection  tasks  is  constrained  by  institutional  dogma 
that  the  status  quo  is  based  on  strong  engineering  logic,  and 
should  need  no  adju.stment.  This  mindset  inhibits  the  ability 
of  Quality  Assurance  to  respond  to  an  aging  system,  chang- 
ing workforce  dynamics,  and  improvement  initiatives. 

The  Quality  Planning  Requirements  Document,  which  de- 
fines inspection  requirements,  was  well  formulated  but  is  not 
routinely  reviewed.  Indeed,  NASA  seems  reluctant  to  add  or 
subtract  government  inspections,  particularly  at  Kennedy. 
Additions  and  subtractions  are  rare,  and  generally  occur 
only  as  a  response  to  obvious  problems.  For  instance,  NASA 
augmented  wiring  inspections  after  .STS-93  in  1999.  when  a 
short  circuit  shut  down  two  of  Coliinihia'^  Main  Engine  Con- 
trollers. Interviews  confirmed  that  the  current  Requirements 
Document  lacks  numerous  critical  items,  but  conversely  de- 
mands redundant  and  unnecessai^  inspections. 

The  NASA/United  Space  Alliance  Quality  Assurance  pro- 
cesses at  Kennedy  are  not  fully  integrated  with  each  other, 
with  Safety,  Health,  and  Independent  Assessment,  or  with 
Engineering  Surveillance  Programs.  Individually,  each 
plays  a  vital  role  in  the  control  and  assessment  of  the  Shuttle 
as  it  comes  together  in  the  Orbiter  Processing  Facility  and 
Vehicle  Assembly  Building.  Were  they  to  be  carefully  inte- 
grated, these  programs  could  attain  a  nearly  comprehensive 
quality  control  process.  Marshall  has  a  similar  challenge.  It 
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Figure  10.4-3.  NASA  Safety  Reporting  System  Form. 
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is  responsible  for  managing  several  different  Shuttle  sys- 
tems through  contractors  who  maintain  mostly  proprietary 
databases,  and  therefore,  integration  is  limited.  The  main 
engine  program  overcomes  this  challenge  by  being  centrally 
organized  under  a  single  Mission  Assurance  Division  Chief 
who  reports  to  the  Marshall  Center  Director  In  contrast. 
Kennedy  has  a  separate  Mission  Assurance  office  working 
directly  for  each  program,  a  separate  Safety.  Health,  and  In- 
dependent Assessment  office  under  the  Center  Director,  and 
separate  quality  engineers  under  each  program.  Observing 
the  effectiveness  of  Marshall,  and  other  successful  Mission 
Assurance  programs  (such  as  at  Johnson  Space  Center),  a 
solution  may  be  the  consolidation  of  the  Kennedy  Space 
Center  Quality  Assurance  program  under  one  Mission  As- 
surance office,  which  would  report  to  the  Center  Director. 

While  reports  by  the  1986  Rogers  Commission,  2000  Shuttle 
Independent  Assessment  Team,  and  2003  internal  Kennedy 
Tiger  Team  all  affirmed  the  need  for  a  strong  and  independent 
Quality  Assurance  Program,  Kennedy's  Program  has  taken 
the  opposite  tack.  Kennedy's  Quality  Assurance  program 
discrepancy-tracking  system  is  inadequate  to  nonexistent. 

Robust  as  recently  as  three  years  ago,  Kennedy  no  longer 
has  a  "closed  loop"  system  in  which  discrepancies  and 
their  remedies  circle  back  to  the  person  who  first  noted  the 
problem.  Previous  methods  included  the  NAS.A  Corrective 
Action  Report,  two-way  memos,  and  other  tools  that  helped 
ensure  that  a  discrepancy  would  be  addressed  and  corrected. 
The  Kennedy  Quality  Program  Manager  cancelled  these 
programs  in  favor  of  a  contractor-run  database  called  the 
Quality  Control  Assessment  Tool.  However,  it  does  not 
demand  a  closed-loop  or  reply  deadline,  and  suffers  from 
limitations  on  effective  data  entry  and  retrieval. 

Kennedy  Quality  Assurance  management  has  recently  fo- 
cused its  efforts  on  implementing  the  International  Organiza- 
tion for  Standardization  (ISO)  9000/9(X)l,  a  process-driven 
program  originally  intended  for  manufacturing  plants.  Board 
observations  and  interviews  underscore  areas  where  Kenne- 
dy has  diverged  from  its  Apollo-era  reputation  of  setting  the 
standard  for  quality.  With  the  implementation  of  Internation- 
al Standardization,  it  could  devolve  further  While  ISO  9000/ 
9001  expresses  strong  principles,  they  are  more  applicable 
to  manufacturing  and  repetitive-procedure  industries,  such  as 


HEX  Stomps  Recorded  FYOl  thru  FY03  (October  1,  2000  -  April  2,  2003) 


HEX  stomps  categori 


Figure    10.4-4     Rejecfion,   or   "Hex"  stamps  issued  from  Ocfober 
2000  fhrough  Apnl  2003. 


running  a  major  airline,  than  to  a  research-and-development, 
non-operational  flight  test  environment  like  that  of  the  Space 
Shuttle.  NASA  technicians  may  perform  a  specific  procedure 
only  three  or  four  times  a  year,  in  contrast  with  their  airline 
counterparts,  who  pert'orm  procedures  dozens  of  times  each 
week.  In  NASA's  own  words  regarding  standardization, 
"ISO  9001  is  not  a  management  panacea,  and  is  never  a 
replacement  for  management  taking  responsibility  for  sound 
decision  making."  Indeed,  many  perceive  International  Stan- 
dardization as  emphasizing  process  over  product. 

Efforts  by  Kennedy  Quality  Assurance  management  to  move 
its  workforce  towards  a  "hands-off,  eyes-off "  approach  are 
unsettling.  To  use  a  term  coined  by  the  2000  Shuttle  In- 
dependent Assessment  Team  Report,  "diving  catches,"  or 
last-minute  saves,  continue  to  occur  in  maintenance  and 
processing  and  pose  serious  hazards  to  Shuttle  safety.  More 
disturbingly,  some  proverbial  balls  are  not  caught  until  af- 
ter flight.  For  example,  documentation  revealed  instances 
where  Shuttle  components  stamped  "ground  test  only"  were 
detected  both  before  and  after  they  had  flown.  Addition- 
ally, testimony  and  documentation  submitted  by  witnesses 
revealed  components  that  had  flown  "as  is"  without  proper 
disposition  by  the  Material  Review  Board  prior  to  flight, 
which  implies  a  growing  acceptance  of  risk.  Such  incidents 
underscore  the  need  to  expand  government  inspections  and 
surveillance,  and  highlight  a  lack  of  communication  be- 
tween NASA  employees  and  contractors. 

Another  indication  of  continuing  problems  lies  in  an  opinion 
voiced  by  many  witnesses  that  is  confirmed  by  Board  track- 
ing: Kennedy  Quality  Assurance  management  discourages 
inspectors  from  rejecting  contractor  work.  Inspectors  are 
told  to  cooperate  with  contractors  to  fix  problems  rather 
than  rejecting  the  work  and  forcing  contractors  to  resub- 
mit it.  With  a  rejection,  discrepancies  become  a  matter  of 
record;  in  this  new  process,  discrepancies  are  not  recorded 
or  tracked.  As  a  result,  discrepancies  are  currently  not  being 
tracked  in  any  easily  accessible  database. 

Of  the  141,127  inspections  subject  to  rejection  from  Oc- 
tober 2000  through  March  2003,  only  20  rejections,  or 
"hexes,"  were  recorded,  resulting  in  a  .statistically  improb- 
able discrepancy  rate  of  .014  percent  (see  Figure  10.4-4).  In 
interviews,  technicians  and  inspectors  alike  confirmed  the 
dubiousness  of  this  rate.  NASA's  published  rejection  rate 
therefore  indicates  either  inadequate  documentation  or  an 
underused  system.  Testimony  further  revealed  incidents  of 
quality  assurance  inspectors  being  played  against  each  other 
to  accept  work  that  had  originally  been  refused. 

Findings: 

FlO.4-1  Shuttle  System  industrial  safety  programs  are  in 
good  health. 

F  10.4-2  The  Quality  Planning  Requirements  Document, 
which  defines  inspection  conditions,  was  well 
formulated.  However,  there  is  no  requirement 
that  it  be  routinely  reviewed. 

F  10.4-3  Kennedy  Space  Center's  current  government 
mandatory  inspection  process  is  both  inadequate 
and  difficult  to  expand,  which  inhibits  the  ability 
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of  Quality  Assurance  to  process  improvement 
initiatives. 
FIO.4-4  Kennedy's  quality  assurance  system  encourages 
inspectors  to  allow  incorrect  work  to  be  corrected 
without  being  labeled  "rejected."  These  opportu- 
nities hide  "rejections,"  making  it  impossible  to 
determine  how  often  and  on  what  items  frequent 
rejections  and  errors  occur 

Observations: 

0 10.4- 1  Perform  an  independently  led,  bottom-up  review 
of  the  Kennedy  Space  Center  Quality  Planning 
Requirements  Document  to  address  the  entire 
quality  assurance  program  and  its  administra- 
tion. This  review  should  include  development  of 
a  responsive  system  to  add  or  delete  government 
mandatory  inspections. 

01 0.4-2  Kennedy  Space  Center's  Quality  Assurance 
programs  should  be  consolidated  under  one 
Mission  Assurance  office,  which  reports  to  the 
Center  Director. 

0 1 0.4-3  Kennedy  Space  Center  quality  assurance  man- 
'  agement  must  work  with  NASA  and  perhaps 
the  Department  of  Defen.se  to  develop  training 
programs  for  its  personnel. 

0 10.4-4  Kennedy  Space  Center  should  examine  which 
areas  of  International  Organization  for  Stan- 
dardization 9000/9001  truly  apply  to  a  20-year- 
old  research  and  development  system  like  the 
Space  Shuttle. 

10.5  Maintenance  Documentation 

The  Board  reviewed  Coliiinbia's  maintenance  records  for 
any  documentation  problems,  evidence  of  maintenance 
fiaw^,  or  significant  omissions,  and  simultaneously  inves- 
tigated the  organizations  and  management  responsible  for 
this  documentation.  The  review  revealed  both  inaccurate 
data  entries  and  a  widespread  inability  to  find  and  correct 
these  inaccuracies. 

The  Board  asked  Kennedy  Space  Center  and  United  Space 
Alliance  to  review  documentation  for  STS-107,  STS-109, 
and  Coliiiiihici's  most  recent  Orbiter  Major  Modification.  A 
NASA  Process  Review  Team,  consisting  of  445  NASA  engi- 
neers, contractor  engineers,  and  Quality  Assurance  person- 
nel, reviewed  some  16,500  Work  Authorization  Documents, 
and  provided  a  list  of  Findings  (potential  relationships  to 
the  accident).  Technical  Observations  (technical  concerns 
or  process  issues),  and  Documentation  Observations  (minor 
errors).  The  list  contained  one  Finding  related  to  the  Exter- 
nal Tank  bipod  ramp.  None  of  the  Observations  contributed 
to  the  accident. 

The  Process  Review  Team's  sampling  plan  resulted  in  excel- 
lent ob.servations.-'^  The  number  of  observations  is  relatively 
low  compared  to  the  total  amount  of  Work  Authorization 
Documents  reviewed,  ostensibly  yielding  a  99.75  percent 
accuracy  rate.  While  this  number  is  high,  a  closer  review  of 
the  data  reveals  some  of  the  system's  weaknes.ses.  Techni- 
cal Observations  are  delineated  into  17  categories.  Five  of 


these  categories  are  of  particular  concern  for  mishap  pre- 
vention and  reinforce  the  need  for  process  improvements. 
The  category  entitled  "System  configuration  could  damage 
hardware"  is  listed  1 1 2  times.  Categories  that  deal  with  poor 
incorporation  of  technical  guidance  are  of  particular  interest 
due  to  the  Board's  concern  over  the  backlog  of  unincorpo- 
rated engineering  orders.  Finally,  a  category  entitled  "paper 
has  open  work  steps,"  indicates  that  the  review  system  failed 
to  catch  a  potentially  significant  oversight  310  times  in  this 
sample.  (The  complete  results  of  this  review  may  be  found 
in  Appendix  D.  14.) 

The  ciMTent  process  includes  three  or  more  layers  of 
tnersight  before  paperwork  is  scanned  into  the  database. 
However,  if  review  authorities  are  not  aware  of  the  most 
common  problems  to  look  for,  corrections  cannot  be  made. 
Routine  sampling  will  help  refine  this  process  and  cut  eiTors 
significantly. 

Observations: 

0 1 0.5-1  Quality  and  Engineering  review  of  work  docu- 
ments for  STS- 1 14  should  be  accomplished  using 
statistical  sampling  to  ensure  that  a  representative 
sample  is  evaluated  and  adequate  feedback  is 
communicated  to  resolve  documentation  prob- 
lems. 

0 1 0.5-2  NASA  should  implement  United  Space  Alliance's 
suggestions  for  process  improvement,  which  rec- 
ommend including  a  statistical  sampling  of  all 
future  paperwork  to  identify  recurring  problems 
and  implement  corrective  actions. 

01 0.5-3  NASA  needs  an  oversight  process  to  statistically 
sample  the  work  performed  and  documented  by 
Alliance  technicians  to  ensure  process  control, 
compliance,  and  consistency. 

10.6  Orbiter  Maintenance  Down  Period/ 
Orbiter  Major  Modification 

During  the  Orbiter  Major  Modification  process,  Orbiters 
are  removed  from  service  for  inspections,  maintenance, 
and  modification.  The  process  occm^s  every  eight  flights  or 
three  years. 

Orbiter  Major  Modifications  combine  with  Orbiter  flows 
(preparation  of  the  vehicle  for  its  next  mission)  and  in- 
clude Orbiter  Maintenance  Down  Periods  (not  every  Or- 
biter Maintenance  Down  Period  includes  an  Orbiter  Major 
Modification).  The  primary  differences  between  an  Orbiter 
Major  Modification  and  an  Orbiter  How  are  the  larger  num- 
ber of  requirements  and  the  greater  degree  of  intrusiveness 
of  a  modification  (a  recent  comparison  showed  8,702  Or- 
biter Major  Modification  requirements  versus  3,826  flow 
requirements). 

Ten  Orbiter  Major  Modifications  have  been  performed  to 
date,  with  an  eleventh  in  progress.  They  have  varied  from  6 
to  20  months.  Because  missions  do  not  occur  at  the  rate  the 
Shuttle  Program  anticipated  at  its  inception,  it  is  endlessly 
challenged  to  meet  numerous  calendar-based  requirements. 
These  must  be  performed  regardless  of  the  lower  flight 
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rate,  which  contributes  to  extensive  downtime.  The  Shuttle 
Program  has  explored  the  possibility  of  extending  Orbiter 
Major  Modification  cycles  to  once  every  12  flights  or  six 
years.  This  initiative  runs  counter  to  the  industry  norm  of 
increasing  the  frequency  of  inspections  as  systems  age,  and 
should  be  carefully  scrutinized,  particularly  in  light  of  the 
high-performance  Orbiters"  demands. 

Orbiter  Major  Modifications  underwent  a  significant 
change  when  they  were  relocated  from  the  Boeing  facil- 
ity in  Palmdale.  California,  (where  the  Orbiters  had  been 
manufactured)  to  Kennedy  Space  Center  in  September 
2002.  The  major  impetus  for  this  change  was  budget  short- 
ages in  Fiscal  Years  2002  and  2003.  The  move  capitalizes 
on  many  advantages  at  Kennedy,  including  lower  labor  and 
utility  costs  and  more  efficient  use  of  existing  overhead, 
while  eliminating  expensive,  underused,  and  redundant 
capabilities  at  Palmdale.  However,  the  move  also  created 
new  challenges:  for  instance,  it  complicates  the  integration 
of  planning  and  scheduling,  and  forces  the  Space  Shuttle 
Program  to  maintain  a  fluid  workforce  in  which  employees 
must  repeatedly  change  tasks  as  they  shift  between  Orbiter 
Major  Modifications,  flows,  and  downtime. 

Throughout  the  history  of  Orbiter  Major  Modifications,  a 
major  area  of  concern  has  been  their  wide  variability  in  con- 
tent and  duration.  Columbia's  last  Orbiter  Major  Modifica- 
tion is  just  the  most  recent  example  of  overruns  due  to  tech- 
nical surprises  and  management  difficulties.  It  exceeded  the 
schedule  by  186  days.  While  many  factors  contributed  to 
this  delay,  the  two  most  prominent  were  the  introduction 
of  a  major  wiring  inspection  one  month  after  Orbiter  Major 
Modification  roll-in,  and  what  an  internal  NASA  assess- 
ment cited  as  "poor  performance  on  the  parts  of  NASA. 
USA  [United  Space  Alliance],  and  Boeing." 

While  the  Shuttle  Program  has  made  efforts  to  correct  these 
problems,  there  is  still  much  to  be  done.  The  transfer  to 
Kennedy  creates  a  steep  learning  curve  both  for  technicians 
and  managers.  Planning  and  scheduling  the  integration  of 
all  three  Orbiters.  as  well  as  ground  support  systems  main- 
tenance, is  critical  to  limit  competition  for  resources.  More- 
over, estimating  the  "right"  amount  of  work  required  on 
each  Orbiter  continues  to  be  a  challenge.  For  example.  20 
modifications  were  planned  for  Discovery's  modification; 
the  number  has  since  grown  to  84.  Such  changes  introduce 
turmoil  and  increase  the  potential  for  mistakes. 

An  Air  Force  "benchmarking"  visit  in  June  2003  high- 
lighted the  need  for  better  planning  and  more  scheduling 
stability.  It  further  recommended  improvements  to  the  re- 
quirements feedback  process  and  incorporating  service  life 
extension  actions  into  Orbiter  Major  Modifications. 

Observations: 

01 0.6-1  The  Space  Shuttle  Program  Office  must  make 
every  effort  to  achieve  greater  stability,  con- 
sistency, and  predictability  in  Orbiter  Major 
Modification  planning,  scheduling,  and  work 
standards  (particularly  in  the  number  of  modi- 
fications). Endless  changes  create  unnecessary 


turmoil  and  can  adversely  impact  quality  and 
safety. 

0 10.6-2  NASA  and  United  Space  Alliance  managers 
must  understand  workforce  and  infrastructure 
requirements,  match  them  against  capabilities, 
and  take  actions  to  avoid  exceeding  thresholds. 

01 0.6-3  NASA  should  continue  to  work  with  the  U.S.  Air 
Force,  particularly  in  areas  of  program  manage- 
ment that  deal  with  aging  systems,  service  life 
extension,  planning  and  scheduling,  workforce 
management,  training,  and  quality  assurance. 

01 0.6-4  The  Space  Shuttle  Program  Office  must  deter- 
mine how  it  will  effectively  meet  the  challenges 
of  inspecting  and  maintaining  an  aging  Orbiter 
fleet  before  lengthening  Orbiter  Major  Mainte- 
nance intervals. 

10.7  Orbiter  Corrosion 

Removing  and  replacing  Thermal  Protection  System  tiles 
sometimes  results  in  damage  to  the  anti-corrosion  primer 
that  covers  the  Orbiters'  sheet  metal  skin.  Tile  replacement 
often  occurs  without  first  re-priming  the  primed  aluminum 
substrate.  The  current  repair  practice  allows  Room  Tem- 
perature Vulcanizing  adhesive  to  be  applied  over  a  bare 
aluminum  substrate  (with  no  Koropon  corrosion-inhibiting 
compound)  when  bonding  tile  to  the  Orbiter. 

A  video  borescope  of  Coliimhia  prior  to  STS-107  found 
corrosion  on  the  lower  forward  fuselage  skin  panel  and 
stringer  areas.  Corrosion  on  visible  rivets  and  on  the  sides 
and  feet  of  stringer  sections  was  also  uncovered  during 
borescope  inspections,  but  was  not  repaired. 

Other  corrosion  concerns  focus  on  the  area  between  the 
crew  module  and  outer  hull,  which  is  a  difficult  area  to  ac- 
cess for  inspection  and  repair  .At  present,  corrosion  in  this 
area  is  only  monitored  with  borescope  inspections.  There  is 
also  concern  that  unchecked  corrosion  could  progress  from 
internal  areas  to  external  surfaces  through  fastener  holes, 
joints,  or  directly  through  the  skin.  If  this  occurs  beneath 
the  tile,  the  tile  system  bond  line  could  degrade. 

Long-Term  Corrosion  Detection 

Limited  accessibility  renders  some  corrosion  damage  dif- 
ficult to  detect.  Approximately  90  percent  of  the  Orbiter 
structure  (excluding  the  tile-covered  outer  mold  line)  can 
be  inspected  for  corrosion.-'  Corrosion  in  the  remaining  10 
percent  may  remain  undetected  for  the  life  of  the  vehicle. 

NASA  has  recently  outlined  a  $70  million,  19-year  pro- 
gram to  assess  and  mitigate  corrosion.  The  agency  fore- 
sees inspection  intervals  based  on  trends  in  the  Problem 
Resolution  and  Corrective  Action  database,  exposure  to 
the  environment,  and  refurbishment  programs.  Develop- 
ment of  a  correlation  between  corrosion  initiation,  growth, 
and  environmental  exposure  requires  the  judicious  use  of 
long-term  test  data.  Moreover,  some  corrosion  problems 
are  uncovered  during  non-corrosion  inspections.  The  risk 
of  undetected  corrosion  may  increase  as  other  inspections 
are  removed  or  intervals  between  inspections  are  extended. 
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Observations: 


10.9  Hold-Down  Post  Cable  Anomaly 


O10.7-1  Additional  and  recurring  evaluation  of  corrosion 
damage  should  include  non-destructive  analysis 
of  the  potential  impacts  on  structural  integrity. 

01 0.7-2  Long-term  corrosion  detection  should  be  a  fund- 
ing priority. 

0 1 0.7-3  Develop  non-destructive  evaluation  inspections 
to  find  hidden  corrosion. 

01 0.7-4  Inspection  requirements  for  coiTOsion  due  to 
environmental  exposure  should  first  establish 
conosion  rates  for  Orbiter-specific  environments, 
materials,  and  structural  configurations.  Consider 
applying  Air  Force  corrosion  prevention  pro- 
grams to  the  Orbiter. 

10.8  BRimE  Fracture  of  A-286  Bolts 

Investigators  sought  to  determine  the  cause  of  brittle  frac- 
tures in  the  A-286  steel  bolts  that  support  the  wing's  lower 
earner  panels,  which  provide  direct  access  to  the  interior  of 
the  Reinforced  Carbon-Carbon  (RCC)  panels.  Any  misalign- 
ment of  the  carrier  panels  affects  the  continuity  of  airflow 
under  the,  wing  and  can  cause  a  "rough  wing"  (see  Chap- 
ter 4).  in  the  end,  57  of  the  88  A-286  bolts  on  Columbia's 
wings  were  recovered;  22  had  brittle  fractures.  The  frac- 
tures occurred  equally  in  two  groups  of  bolts  in  the  same 
locations  on  each  wing.  Investigators  determined  that  liquid 
metal  embrittlement  caused  by  aluminum  vapor  created  by 
G>/»//;/w/'s  breakup  could  have  contributed  to  these  fractures, 
but  the  axial  loads  placed  on  the  bolts  when  they  separated 
from  the  carrier  panel/box  beam  at  temperatures  approaching 
2,000  degrees  Fahrenheit  likely  caused  the  failures. 

Findings: 

FIO.8-1  The  present  design  and  fabrication  of  the  lower 
carrier  panel  attachments  are  inadequate.  The 
bolts  can  readily  pull  through  the  relatively  large 
holes  in  the  box  beams. 

FIO.8-2  The  current  design  of  the  box  beam  in  the  lower 
carrier  panel  assembly  exposes  the  attachment 
bolts  to  a  rapid  exchange  of  air  along  the  wing, 
which  enables  the  failure  of  numerous  bolts. 

F 1 0.8-3  Primers  and  sealants  such  as  Room  Temperature 
Vulcanizing  560  and  Koropon  may  accelerate 
corrosion,  particularly  in  tight  crevices. 

FlO.8-4  The  negligible  compressive  stresses  that  normally 
occur  in  A-286  bolts  help  protect  against  failure. 

Observations: 

OI0.8-I  Teflon  (material)  and  Molybdenum  Disulfide 
(lubricant)  should  not  be  used  in  the  cairier  panel 
bolt  assembly. 

01 0.8-2  Galvanic  coupling  between  aluminum  and  steel 
alloys  must  be  mitigated. 

0 1 0.8-3  The  use  of  Room  Temperature  Vulcanizing  560 
and  Koropon  should  be  reviewed. 

OI0.8-4  Assuring  the  continued  presence  of  compressive 
stresses  in  A-286  bolts  should  be  part  of  their  ac- 
ceptance and  qualification  procedures. 


Each  of  the  two  Solid  Rocket  Boosters  is  attached  to  the 
Mobile  Launch  Platform  by  four  "hold  down"  bolts.  A  five- 
inch  diameter  restraint  nut  that  contains  two  pyrotechnic 
initiators  secures  each  of  these  bolts.  The  initiators  sever 
the  nuts  when  the  Solid  Rocket  Boosters  ignite,  allowing 
the  Space  Shuttle  stack  to  lift  off.  During  launch,  STS-1 12 
suffered  a  failure  in  the  Hold-Down  Post  and  External  Tank 
Vent  Arm  Systems  that  control  the  firing  of  initiators  in  each 
Solid  Rocket  Booster  restraint  nut.  NASA  had  been  warned 
that  a  recurrence  of  this  type  of  failure  could  cause  cata- 
strophic failure  of  the  Shuttle  stack  (see  Appendix  D.  15). 

The  signal  to  fire  the  initiators  begins  in  the  General  Pur- 
pose Computers  and  goes  to  both  of  the  Master  Events 
Controllers  on  the  Orbiter.  Master  Events  Controller  1 
communicates  this  signal  to  the  A  system  cable,  and  Master 
Events  Controller  2  feeds  the  B  system.  The  cabling  then 
goes  through  the  T-0  umbilical  (that  connects  fluid  and 
electrical  connections  between  the  launch  pad  and  the 
Orbiter)  to  the  Pyrotechnics  Initiator  Controllers  and  then 
to  the  initiators.  (There  are  16  Pyrotechnics  Initiator  Con- 
trollers for  Hold  Down  Post  Systems  A  and  B,  and  four  for 
the  External  Tank  Vent  Arm  Systems  A  and  B.)  The  Hold 
Down  Post  System  A  is  hard-wired  to  one  of  the  initiators 
on  each  of  the  four  restraint  nuts  (eight  total)  while  System 
B  is  hard-wired  to  the  other  initiator  on  each  nut.  The  A  and 
B  systems  also  send  a  duplicate  signal  to  the  External  Tank 
Vent  Arm  System.  Either  Master  Events  Controller  will  op- 
erate if  the  other  or  the  intervening  cabling  fails. 

A  post-launch  review  of  STS- 1 12  indicated  that  the  System 
A  Hold-Down  Post  and  External  Tank  Vent  Arm  System 
Pyrotechnics  Initiator  Controllers  did  not  discharge.  Initial 
troubleshooting  revealed  no  malfunction,  leading  to  the 
conclusion  that  the  failure  was  intermittent.  A  subsequent 
investigation  recommended  the  following: 

•  All  T-0  Ground  Cables  will  be  replaced  after  every 
flight. 

•  The  T-f)  interface  to  the  Pyrotechnics  Initiator  Con- 
trollers rack  cable  (Kapton)  is  in  redesign. 

•  All  Orbiter  T-0  Connector  Savers  have  been  re- 
placed. 

•  Pyrotechnic  connectors  will  be  pre-screened  with  pin- 
retention  tests,  and  the  connector  saver  mate  process 
will  be  verified  using  videoscopes. 

However,  prelaunch  testing  procedures  have  not  changed 
and  may  not  be  able  to  identify  intermittent  failures. 

Findings: 

F 1 0.9-1  The  Hold-Down  Post  External  Tank  Vent  Arm 
System  is  a  Criticality  IR  (redundant)  system. 
Before  the  anomaly  on  STS- 1 12,  and  despite 
the  high-criticality  factor,  the  original  cabling 
for  this  system  was  used  repeatedly  until  it  was 
visibly  damaged.  Replacing  these  cables  after  ev- 
ery flight  and  removing  the  Kapton  will  prevent 
bending  and  manipulation  damage. 
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FlO.9-2  NASA  is  unclear  about  the  potential  for  damage 
if  the  system  malfunctions,  oreven  if  one  nut  fails 
to  split.  Several  program  managers  were  asked: 
What  if  the  A  system  fails,  and  a  B-system  initia- 
tor fails  simultaneously?  The  consensus  was  that 
the  system  would  continue  to  burn  on  the  pad  or 
that  the  Solid  Rocket  Booster  would  rip  free  of 
the  pad,  causing  potentially  catastrophic  damage 
to  the  Solid  Rocket  Booster  skirt  and  nozzle  ma- 
neuvering mechanism.  However,  they  agree  that 
the  probability  of  this  is  extremely  low. 

FlO.9-3  With  the  exception  of  STS-112's  anomaly,  nu- 
merous bolt  hang-ups.  and  occasional  Master 
Events  Controller  failures,  these  systems  have  a 
good  record.  In  the  early  design  stages,  risk-miti- 
gating options  were  considered,  including  strap- 
ping with  either  a  wire  that  crosses  over  the  nut 
from  the  A  to  B  side,  or  with  a  toggle  circuit  that 
sends  a  signal  to  the  opposite  side  when  either 
initiator  fires.  Both  options  would  eliminate  the 
potential  of  a  catastrophic  dual  failure.  However, 
they  could  also  create  new  failure  potentials  that 
may  not  reduce  overall  system  risk.  Today's  test 
and  troubleshooting  technology  may  have  im- 
proved the  ability  to  test  circuits  and  potentially 
prevent  intermittent  failures,  but  it  is  not  clear  if 
NASA  has  explored  these  options. 

Observation: 

0 1 0.9- 1  NASA  should  consider  a  redesign  of  the  system, 
such  as  adding  a  cross-strapping  cable,  or  con- 
duct advanced  testing  for  intermittent  failure. 

10.10  Solid  Rocket  Booster  External  Tank 
Ahachment  Ring 

In  Chapter  4,  the  Board  noted  how  NASA's  reliance  on 
"analysis"  to  validate  Shuttle  components  led  to  the  use 
of  flawed  bolt  catchers.  NASA's  use  of  this  flawed  "analy- 
sis" technique  is  endemic.  The  Board  has  found  that  such 
analysis  was  invoked,  with  potentially  dire  consequences, 
on  the  Solid  Rocket  Booster  External  Tank  Attach  Ring. 
Tests  showed  that  the  tensile  strength  of  several  of  these 
rings  was  well  below  minimum  safety  requirements.  This 
problem  was  brought  to  NASA's  attention  shortly  before 
the  launch  of  STS-107.  To  accommodate  the  launch  sched- 
ule, the  External  Tanking  Meeting  chair,  after  a  cursory 
briefing  without  a  full  technical  review,  reduced  the  Attach 
Rings'  minimum  required  safety  factor  of  1.4  (that  is.  able 
to  withstand  1.4  times  the  maximum  load  ever  expected  in 
operations)  to  1.25.  Though  NASA  has  formulated  short- 
and  long-term  corrections,  its  long-term  plan  has  not  yet 
been  authorized. 

Observation: 


10.11  Test  Equipment  Upgrades 

Visits  to  NASA  facilities  (both  government  and  contractor 
operated,  as  well  as  contractor  facilities)  and  interviews 
with  technicians  revealed  the  use  of  1970s-era  oscilloscopes 
and  other  analog  equipment.  Cuirently  available  equipment 
is  digital,  and  in  other  venues  has  proved  to  be  less  costly, 
easier  to  maintain,  and  more  reliable  and  accurate.  With  the 
Shuttle  forecast  to  fly  through  2020,  an  upgrade  to  digital 
equipment  would  avoid  the  high  maintenance,  lack  of  parts, 
and  dubious  accuracy  of  equipment  cunently  used.  New 
equipment  would  require  certification  for  its  uses,  but  the 
benefit  in  accuracy,  maintainability,  and  longevity  would 
likely  outweigh  the  drawbacks  of  certification  costs. 

Observation: 

0 1 0. 1 1  - 1  Assess  NASA  and  contractor  equipment  to  deter- 
mine if  an  upgrade  will  provide  the  reliability  and 
accuracy  needed  to  maintain  the  Shuttle  through 
2020.  Plan  an  aggressive  certification  program 
for  replaced  items  so  that  new  equipment  can  be 
put  into  operation  as  soon  as  possible. 

10.12  Leadership/Managerial  Training 

Managers  at  many  levels  in  NAS.A.,  from  GS-14  to  Associ- 
ate Administrator,  have  taken  their  positions  without  fol- 
lowing a  recommended  standard  of  training  and  education 
to  prepare  them  for  roles  of  increased  responsibility.  While 
NASA  has  a  number  of  in-house  academic  training  and 
career  development  opportunities,  the  timing  and  strategy 
for  management  and  leadership  development  differs  across 
organizations.  Unlike  other  sectors  of  the  Federal  Govern- 
ment and  the  military,  NASA  does  not  have  a  standard 
agency-wide  career  planning  process  to  prepare  its  junior 
and  mid-level  managers  for  advanced  roles.  These  programs 
range  from  academic  fellowships  to  civil  service  education 
programs  to  billets  in  militai7-sponsored  programs,  and  will 
allow  NASA  to  build  a  strong  corps  of  potential  leaders  for 
future  progression. 

Observation: 

Ol  0.12-1  NASA  should  implement  an  agency-wide  strat- 
egy for  leadership  and  management  training 
that  provides  a  more  consistent  and  integrated 
approach  to  career  development.  This  strategy 
should  identify  the  management  and  leadership 
skills,  abilities,  and  experiences  required  for  each 
level  of  advancement.  NASA  should  continue  to 
expand  its  leadership  development  partnerships 
with  the  Department  of  Defense  and  other  exter- 
nal organizations. 


OlO.lO-l  NASA  should  reinstate  a  safety  factor  of  1.4  for 
the  Attachment  Rings— which  invalidates  the 
use  of  ring  serial  numbers  16  and  15  in  their 
present  state  — and  replace  all  deficient  material 
in  the  Attachment  Rings. 
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Endnotes  for  Chapter  10 


The  citations  that  contain  a  reference  to  "CAIB  document"  with  CAB  or 
CTF  followed  by  seven  to  eleven  digits,  such  as  CABOOl-0010,  refer  to  a 
document  in  the  Columbia  Accident  Investigation  Board  database  maintained 
by  the  Department  of  Justice  and  archived  at  the  Notional  Archives. 

'  "And  stunningly.  In  as  much  os  this  was  tragic  and  horrific  through  a 
loss  of  seven  very  important  lives,  it  is  amazing  that  there  were  no  other 
collateral  damage  happened  as  a  result  of  it.  No  one  else  was  injured. 
All  of  the  "claims  hove  been  very,  very  minor  iri  dealing  with  these  issues." 
NASA  Administrator  Sean  O'Keefe,  testimony  before  the  United  States 
Senate  Committee  on  Commerce,  Science,  and  Transportation,  May  14, 
2003. 

An  intensive  search  of  over  a  million  acres  in  Texas  and  Louisiana 
recovered  83,900  pieces  of  Columbia  debris  weighing  a  total  of  84,900 
pounds.  (Over  700,000  acres  were  searched  on  foot,  and  1.6  million 
acres  were  searched  with  aircraft.)  The  latitude  and  longitude  was 
recorded  for  more  than  75,000  of  these  pieces.  The  majority  of  the 
recovered  items  were  no  larger  than  0.5  square  feet.  More  than  40,000 
items  could  not  be  positively  identified  but  were  classified  as  unknown 
tile,  metal,  composite,  plastic,  fabric,  etc.  Details  about  the  debris 
reconstruction  and  recovery  effort  are  provided  in  Appendix  E.5,  S. 
Altemis,  J.  Cowart,  W.  Woodworth,  "STS-107  Columbia  Reconstruction 
Report,"  NSTS-60501,  June  30,  2003.  CAIB  document  CTF076- 
20302182. 

The  precise  probability  is  uncertain  due  to  many  factors,  such  as  the 
amount  of  debris  that  burned  up  during  re-entry,  and  the  fraction  of  the 
population  that  was  outdoors  when  the  Coiumtia  accident  occurred. 

"User's  Guide  for  Object  Reentry  Survival  Analysis  Tool  (ORSAT), 
Version  5.0,  Volume  l-Methodology,  Input  Description,  and  Results," 
JSC-28742,  July  1999;  W.  Alior,  "V/hot  Con  V/e  Learn  From  Recovered 
Debris,"  Aerospace  Corp,  briefing  presented  to  CAIB,  on  March  13, 
2003. 

"Reentry  Survivability  Analysis  of  Delta  IV  Launch  Vehicle  Upper  Stage," 
JSC-29775,  June  2002. 

'  Anolysis  of  the  recovered  debris  indicates  that  relatively  few  pieces 
posed  a  threat  to  people  indoors.  See  Appendix  D.16. 

Detailed  information  about  individual  frogments,  including  weight  in 
most  cases,  was  not  available  for  the  study.  Therefore,  some  engineering 
discretion  was  needed  to  develop  models  of  individual  weights, 
dimensions,  aerodynamic  characteristics,  and  conditions  of  impact.  This 
lack  of  information  increases  uncertainty  in  the  accuracy  of  the  final 
results.  The  study  should  be  revisited  after  the  fragment  data  has  been 
fully  choracterized. 

K.M.  Thompson,  R.F.  Rabouw,  and  R.M.  Cooke,  "The  Risk  of  Groundling 
Fatalities  from  Unintentional  Airplane  Crashes,"  Risk  Analysis,  Vol.  21, 
No.  6,  2001. 

"     Ibid. 

The  civil  aviation  study  indicates  that  the  risk  to  groundlings  is  significantly 
higher  in  the  vicinity  of  on  airport.  The  overage  annual  risk  of  fatality 
within  0.2  miles  of  a  busy  (top  100)  oirport  is  about  1  in  a  million. 

Thompson,  "The  Risk  of  Groundling  Fatalities,"  Code  of  Federal 
Regulations  (CFR)  14  CFR  Port  415,  415,  and  417,  "Licensing  and  Safety 
Requirements  for  Launch:  Proposed  Rule,"  Federal  Register  Vol.  67,  No. 
146,  July  30,  2002,  p.  49495. 


Code  of  Federal  Regulations  (CFR)  14  CFR  Part  415  Launch  License, 
Federal  Register  Vol.  64,  No.  76,  April  21,  1999;  Range  Commanders 
Council  Standard  321-02,  "Common  Risk  Criteria  for  Notional  Test 
Ranges,"  published  by  the  Secretariat  of  the  RCC  U.S.  Army  White  Sands 
Missile  Range,  NM  88002-5110,  June  2002;  "Mitigation  of  Orbital 
Debris,"  Notice  of  Proposed  Rulemaking  by  the  Federal  Communications 
Commission,  FCC  02-80,  Federal  Register  Vol.  67,  No.  86,  Friday,  May 
3,  2002. 

Air  Force  launch  safety  standards  define  a  Hazardous  Launch  Area,  a 
controlled  surface  area  and  airspace,  where  individual  risk  of  serious 
injury  from  a  launch  vehicle  malfunction  during  the  early  phase  of 
flight  exceeds  one  in  a  million.  Only  personnel  essential  to  the  launch 
operation  are  permitted  in  this  area.  "Eastern  and  Western  Range 
Requirements  127-1,"  March  1995,  pp.  1-12  and  Fig.  1-6. 

Code  of  Federal  Regulations  (CFR)  14  CFR  Part  431,  Launch  and  Reentry 
of  a  Reusable  Launch  Vehicle,  Section  35  paragraphs  (a)  and  (b). 
Federal  Register  Vol.  65,  No.  182,  September  19,  2000,  p.  56660. 

"Reentry  Survivability  Analysis  of  Delta  IV  Launch  Vehicle  Upper  Stage," 
JSC-29775,  June  2002. 

M.  Tobin,  "Range  Safety  Risk  Assessments  For  Kennedy  Space  Center," 
October  2002.  CAIB  document  CTF059-22802288;  "Space  Shuttle 
Program  Requirements  Document,"  NSTS-07700,  Vol.  I,  change  no.  76, 
Section  5-1.  CAIB  document  CAB024-04120475. 

Here,  ascent  refers  to  (1)  the  Orbiter  from  liftoff  to  Main  Engine  Cut  Off 
(MECO),  (2)  the  Solid  Rocket  Boosters  from  liftoff  to  splashdown,  and  (3) 
the  External  Tank  from  liftoff  to  splashdown. 

Pete  Cadden,  "Shuttle  Launch  Area  Debris  Risk,"  October  2002.  CAIB 
document  CTF059-22682279. 

See  Dennis  R.  Jenkins,  Space  Shuttle:  The  History  of  the  National  Space 
Transportation  Syslen)  -  The  First  TOO  Missions  (Cope  Canaveral, 
FL,  Specialty  Press,  2001),  pp.  205-212  for  a  complete  description 
of  the  Approach  and  Landing  Tests  and  other  testing  conducted  with 
Enterprise. 

Report  of  the  Presidential  Commission  on  the  Space  Shuttle  Challenger 
Accident  (Washington;  Government  Printing  Office,  1986). 

The  pre-declared  time  period  or  number  of  missions  over  which  the 
system  is  expected  to  operate  without  major  redesign  or  redefinition. 

"A  crew  escape  system  shall  be  provided  on  Earth  to  Orbit  vehicles  for 
safe  crew  extraction  and  recovery  from  in-flight  failures  across  the  flight 
envelope  from  pre-launch  to  landing.  The  escape  system  shall  hove  a 
probability  of  successful  crew  return  of  0.99." 

Report  of  the  Aerospace  Safety  Advisory  Panel  Annual  Report  for  2002, 
(Washington:  Government  Printing  Office,  March  2002).  CAIB  document 
CTF014-25882645. 

Charlie  Abner,  "KSC  Processing  Review  Team  Final  Summary,"  June  16, 
2003.  CAIB  document  CTF063-11801276. 

Julie  Kramer,  et  ol.,  "Minutes  from  CAIB  /  Engineering  Meeting  to 
Discuss  CAIB  Action  /  Request  for  Information  B 1-0001 93,"  April  24, 
2003.  CAIB  document  CTF042-00930095. 
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Chapter  11 


Recommendations 


It  is  the  Board's  opinion  tiiat  good  leadership  can  direct 
a  culture  to  adapt  to  new  realities.  NASA's  culture  must 
change,  and  the  Board  intends  the  following  recommenda- 
tions to  be  steps  toward  effecting  this  change. 

Recommendations  have  been  put  forth  in  many  of  the  chap- 
ters. In  this  chapter,  the  recommendations  are  grouped  by 
subject  area  with  the  Retum-to-Flight  (RTF]  tasks  listed 
first  within  the  subject  area.  Each  Recommendation  retains 
its  number  so  the  reader  can  refer  to  the  related  section  for 
additional  details.  These  recommendations  are  not  listed  in 
priority  order. 


Part  One  -  The  Accident 

Thermal  Protection  System 

R3.2-1  Initiate  an  aggressive  program  to  eliminate  all 
External  Tank  Thermal  Protection  System  debris- 
shedding  at  the  source  with  particular  emphasis 
on  the  region  where  the  bipod  struts  attach  to  the 
External  Tank.  [RTF] 

R3.3-2  Initiate  a  program  designed  to  increase  the 
Orbiter's  ability  to  sustain  minor  debris  damage 
by  measures  such  as  improved  impact-resistant 
Reinforced  Carbon-Carbon  and  acreage  tiles. 
This  program  should  determine  the  actual  impact 
resistance  of  current  materials  and  the  effect  of 
likely  debris  strikes.  (RTF] 

R3.3- 1  Develop  and  implement  a  comprehensive  inspec- 
tion plan  to  determine  the  structural  integrity  of 
all  Reinforced  Carbon-Carbon  system  compo- 
nents. This  inspection  plan  should  take  advantage 
of  advanced  non-destructive  inspection  technol- 
ogy. [RTF] 

R6.4-1  For  missions  to  the  International  Space  Station, 
develop  a  practicable  capability  to  inspect  and 
effect  emergency  repairs  to  the  widest  possible 
range  of  damage  to  the  Thermal  Protection  Sys- 
tem, including  both  tile  and  Reinforced  Carbon- 


Carbon,  taking  advantage  of  the  additional  capa- 
bilities available  when  near  to  or  docked  at  the 
International  Space  Station. 

For  non-Station  missions,  develop  a  comprehen- 
sive autonomous  (independent  of  Station)  inspec- 
tion and  repair  capability  to  cover  the  widest 
possible  range  of  damage  scenarios. 

Accomplish  an  on-orbit  Thermal  Protection 
System  inspection,  using  appropriate  assets  and 
capabilities,  early  in  all  missions. 

The  ultimate  objective  should  be  a  fully  autono- 
mous capability  for  all  missions  to  address  the 
possibility  that  an  International  Space  Station 
mission  fails  to  achieve  the  correct  orbit,  fails  to 
dock  successfully,  or  is  damaged  during  or  after 
undocking.  [RTF] 

R3.3-3  To  the  extent  possible,  increase  the  Orbiter's  abil- 
ity to  successfully  re-enter  Earth's  atmosphere 
with  minor  leading  edge  structural  sub-system 
damage. 

R3.3-4  In  order  to  understand  the  true  material  character- 
istics of  Reinforced  Carbon-Carbon  components, 
develop  a  comprehensive  database  of  flown  Rein- 
forced Carbon-Carbon  material  characteristics  by 
destructive  testing  and  evaluation. 

R3.3-5  Improve  the  maintenance  of  launch  pad  struc- 
tures to  minimize  the  leaching  of  zinc  primer 
onto  Reinforced  Carbon-Carbon  components. 

R3.8-1  Obtain  sufficient  spare  Reinforced  Carbon-Car- 
bon panel  assemblies  and  associated  support 
components  to  ensure  that  decisions  on  Rein- 
forced Carbon-Carbon  maintenance  are  made 
on  the  basis  of  component  specifications,  free  of 
external  pressures  relating  to  schedules,  costs,  or 
other  considerations. 
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R3.8-2  Develop,  validate,  and  maintain  physics-based 
computer  models  to  evaluate  Thermal  Protec- 
tion System  damage  from  debris  impacts.  These 
tools  should  provide  realistic  and  timely  esti- 
mates of  any  impact  damage  from  possible  de- 
bris from  any  source  that  may  ultimately  impact 
the  Orbiter.  Establish  impact  damage  thresholds 
that  trigger  responsive  corrective  action,  such  as 
on-orbit  inspection  and  repair,  when  indicated. 


Imaging 

R3.4-I 


Upgrade  the  imaging  system  to  be  capable  of 
providing  a  minimum  of  three  useful  views  of 
the  Space  Shuttle  from  liftoff  to  at  least  Solid 
Rocket  Booster  separation,  along  any  expected 
ascent  azimuth.  The  operational  status  of  these 
assets  should  be  included  in  the  Launch  Com- 
mit Criteria  for  future  launches.  Consider  using 
ships  or  aircraft  to  provide  additional  views  of 
the  Shuttle  during  ascent.  [RTF] 


R3.4-2  Provide  a  capability  to  obtain  and  downlink 
high-resolution  images  of  the  External  Tank 
after  it  separates.  [RTF] 

R3.4-3  Provide  a  capability  to  obtain  and  downlink 
high-resolution  images  of  the  underside  of  the 
Orbiter  wing  leading  edge  and  forward  section 
of  both  wings'  Thermal  Protection  System. 

[RTF] 

R6.3-2  Modify  the  Memorandum  of  Agreement  with 
the  National  Imagery  and  Mapping  Agency  to 
make  the  imaging  of  each  Shuttle  flight  while  on 
orbit  a  standard  requirement.  [RTF] 


Orbiter  Sensor  Data 


R3.6-I 


R3.6-2 


Wiring 

R4.2-2 


The  Modular  Auxiliary  Data  System  instrumen- 
tation and  sensor  suite  on  each  Orbiter  should  be 
maintained  and  updated  to  include  current  sen- 
sor and  data  acquisition  technologies. 

The  Modular  Auxiliary  Data  System  should  be 
redesigned  to  include  engineering  performance 
and  vehicle  health  information,  and  have  the 
ability  to  be  reconfigured  during  flight  in  order 
to  allow  certain  data  to  be  recorded,  telemetered, 
or  both  as  needs  change. 


As  part  of  the  Shuttle  Service  Life  Extension 
Program  and  potential  40-year  service  life, 
develop  a  state-of-the-art  means  to  inspect  all 
Orbiter  wiring,  including  that  which  is  inacces- 
sible. 


Bolt  Catchers 

R4.2-I        Test  and  qualify  the  flight  hardware  bolt  catch- 
ers. [RTF] 


Closeouts 

R4.2-3  Require  that  at  least  two  employees  attend  all 
final  closeouts  and  intertank  area  hand-spraying 
procedures,  [RTF] 


Micrometeoroid  and  Orbital  Debris 

R4.2-4  Require  the  Space  Shuttle  to  be  operated  with 
the  same  degree  of  safety  for  micrometeoroid 
and  orbital  debris  as  the  degree  of  safety  calcu- 
lated for  the  International  Space  Station.  Change 
the  micrometeoroid  and  orbital  debris  safety  cri- 
teria from  guidelines  to  requirements. 


Foreign  Object  Debris 

R4.2-5  Kennedy  Space  Center  Quality  Assurance 
and  United  Space  Alliance  must  return  to  the 
straightforward,  industry-standard  definition  of 
"Foreign  Object  Debris"  and  eliminate  any  al- 
ternate or  statistically  deceptive  definitions  like 
"processing  debris."  [RTF] 


Part  Two  -  Why  the  Accident  Occurred 


Scheduling 


R6.2- 


Training 


R6.3-I 


Adopt  and  maintain  a  Shuttle  flight  schedule 
that  is  consistent  with  available  resources. 
Although  schedule  deadlines  are  an  important 
management  tool,  those  deadlines  must  be 
regularly  evaluated  to  ensure  that  any  additional 
risk  incurred  to  meet  the  schedule  is  recognized, 
understood,  and  acceptable.  [RTF] 


Implement  an  expanded  training  program  in 
which  the  Mission  Management  Team  faces 
potential  crew  and  vehicle  safety  contingencies 
beyond  launch  and  ascent.  These  contingencies 
should  involve  potential  loss  of  Shuttle  or  crew, 
contain  numerous  uncertainties  and  unknowns, 
and  require  the  Mission  Management  Team  to 
assemble  and  interact  with  support  organiza- 
tions across  NASA/Contractor  lines  and  in  vari- 
ous locations.  [RTF] 
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Organization 

R7.5-I  Establish  an  independent  Technical  Engineer- 
ing Authority  that  is  responsible  for  technical 
requirements  and  all  waivers  to  them,  and  will 
build  a  disciplined,  systematic  approach  to 
identifying,  analyzing,  and  controlling  hazards 
throughout  the  life  cycle  of  the  Shuttle  System. 
The  independent  technical  authority  does  the  fol- 
lowing as  a  minimum: 

•  Develop  and  maintain  technical  standards 
for  all  Space  Shuttle  Program  projects  and 
elements 

•  Be  the  sole  waiver-granting  authority  for 
all  technical  standards 

•  Conduct  trend  and  risk  analysis  at  the  sub- 
system, system,  and  enterprise  levels 

•  Own  the  failure  mode,  effects  analysis  and 
hazard  reptiiting  systems 

•  Conduct  integrated  hazard  analysis 

•  Decide  what  is  and  is  not  an  anomalous 
event 

•  Independently  verify  launch  readiness 

•  Approve  the  provisions  of  the  recertifica- 
tion  program  called  for  in  Recommenda- 
tion R9.1-1. 


RecerHfication 

R9.2-I  Prior  to  operating  the  Shuttle  beyond  2010, 
develop  and  conduct  a  vehicle  recertification  at 
the  material,  component,  subsystem,  and  system 
levels.  Recertification  requirements  should  be 
included  in  the  Service  Life  E.xtension  Program. 


Closeout  Photos/Drawing  System 

R  10.3-1  Develop  an  interim  program  of  closeout  pho- 
tographs for  all  critical  sub-systems  that  differ 
from  engineering  drawings.  Digitize  the  close- 
out photograph  system  so  that  images  are  imme- 
diately available  for  on-orbit  troubleshooting. 

IRTFl 

R  10.3-2  Provide  adequate  resources  for  a  long-term  pro- 
gram to  upgrade  the  Shuttle  engineering  draw- 
ing system  including: 

•  Reviewing  drawings  for  accuracy 

•  Converting  all  drawings  to  a  computer- 
aided  drafting  system 

•  Incorporating  engineering  changes 


R7.5-2 


The  Technical  Engineering  Authority  should  be 
funded  directly  from  NASA  Headquarters,  and 
should  have  no  connection  to  or  responsibility 
for  schedule  or  program  cost. 

NASA  Headquarters  Office  of  Safety  and  Mis- 
sion Assurance  should  have  direct  line  authority 
over  the  entire  Space  Shuttle  Program  safety 
organization  and  should  be  independently  re- 
sourced. 


R7.5-3  Reorganize  the  Space  Shuttle  Integration  Office 
to  make  it  capable  of  integrating  all  elements  of 
the  Space  Shuttle  Program,  including  the  Or- 
biter. 


Part  Three  -  A  Look  Ahead 

Organization 

R9. 1  - 1  Prepare  a  detailed  plan  for  defining,  establishing, 
transitioning,  and  implementing  an  independent 
Technical  Engineering  Authority,  independent 
safety  program,  and  a  reorganized  Space  Shuttle 
Integration  Office  as  described  in  R7..S-1,  R7.5- 
2,  and  R7..'S-3.  In  addition,  NASA  should  submit 
annual  reports  to  Congress,  as  part  of  the  budget 
review  process,  on  its  implementation  activi- 
ties. [RTF] 
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Part  Four 


Sunrise  from  STS107  on  Flight  Day  3 
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Columbia  being  fransporfed  fo  Launch  Complex  39-A  at  fhe  Kennedy  Space  Center,  Florida^  in  preparation  for  STS-107. 
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PPENDIX  A 


The  Investigation 


A.l    Activation  of  the 

Columbia  Accident  Investigation  Board 

At  8:59:32  a.m.  Eastern  Standard  Time  on  Saturday,  February' 
I.  2003,  communication  with  the  Shuttle  Columbia  was  lost. 
Shortly  after  the  planned  landing  time  of  9:16  a.m.,  NASA 
declared  a  Shuttle  Contingency  and  executed  the  Agency 
Contingency  Action  Plan  for  Space  Flight  Operations  that 
had  been  established  after  the  Space  Shuttle  Challenger  ac- 
cident in  January  1986.  As  part  of  that  plan,  NASA  Adminis- 
trator Sean  G'Keefe  deployed  NASA's  Mishap  Investigation 
Team,  activated  the  Headquarters  Contingency  Action  Team, 
and,  at  10:30  a.m.,  activated  the  International  Space  Station 
and  Space  Shuttle  Mishap  Interagency  Investigation  Board. 

The  International  Space  Station  and  Space  Shuttle  Mishap 
Interagency  Investigation  Board  is  designated  in  Appendix 
D  of  the  Agency  Contingency  Action  Plan  as  an  external 
investigating  board  that  works  to  uncover  the  "facts,  as  well 
as  the  actual  or  probable  causes  of  the  Shuttle  mishap"  and 
to  '"recommend  preventative  and  other  appropriate  actions 
to  preclude  the  recurrence  of  a  similar  mishap."'  The  Board 
is  composed  of  seven  members  and  is  chartered  with  provi- 
sions for  naming  a  Chairman  and  additional  members.  The 
seven  members  take  their  position  on  the  Board  because 
they  occupy  specific  government  posts.  At  the  time  of  the 
accident,  these  individuals  included: 

•  Chief  of  Safety,  U.S.  Air  Force:  Major  General  Kenneth 
W.  Hess 

•  Director,  Office  of  Accident  Investigation,  Federal 
Aviation  Administration:  Steven  B.  Wallace 

•  Representative,  U.S.  Air  Force  Space  Command:  Briga- 
dier General  Duane  W.  Deal 

•  Commander,  Naval  Safety  Center:  Rear  Admiral  Ste- 
phen A.  Turcotte 

•  Director,  Aviation  Safety  Division,  Volpe  National 
Transportation  Systems  Center,  Department  of  Trans- 
portation: Dr.  James  N.  Hallock 

•  Representative,  U.S.  Air  Force  Materiel  Command: 
Major  General  John  L.  Barry 

•  Director,  NASA  Field  Center  or  NASA  Program  Asso- 
ciate Administrator  (not  related  to  mission):  Vacant 


Upon  activating  the  Board,  Administrator  O'Keefe  named 
Admiral  Harold  W.  Gehman  Jr.,  United  States  Navy  (re- 
tired), as  its  Chair,  and  G.  Scott  Hubbard,  Director  of  NASA 
Ames  Research  Center,  as  the  NASA  Field  Center  Director 
representative.  In  addition  to  these  eight  voting  members, 
contingency  procedures  provided  for  adding  two  non-vot- 
ing NASA  representatives,  who  helped  establish  the  Board 
during  the  first  weeks  of  activity  but  then  returned  to  their 
regular  duties.  They  were  Bryan  D.  O'Connor.  NASA  A.sso- 
ciate  Administrator  for  Safety  and  Mission  Assurance,  who 
served  as  an  ex-officio  Member  of  the  Board,  and  Theron 
M.  Bradley  Jr..  NASA  Chief  Engineer,  who  served  as  the 
Board's  Executive  Secretary.  Upon  the  Board's  activation, 
two  NASA  officials,  David  Lengyel  and  Steven  Schmidt, 
were  dispatched  to  provide  for  the  Board's  administra- 
tive needs.  J.  William  Sikora,  Chief  Counsel  of  the  Glenn 
Research  Center  in  Cleveland,  Ohio,  was  assigned  as  the 
counsel  to  the  Board. 

By  noon  on  February  1 ,  NASA  officials  notified  most  Board 
members  of  the  mishap  and  issued  tentative  orders  for  the 
Board  to  convene  the  next  day  at  Barksdale  Air  Force  Base 
in  Shreveport,  Louisiana,  where  the  NASA  Mishap  Investi- 
gation Team  was  coordinating  the  .search  for  debris.  At  5:00 
p.m.,  available  Board  members  participated  in  a  teleconfer- 
ence with  NASA's  Headquarters  Contingency  Action  Team. 
During  that  teleconference,  Gehman  proposed  that  the 
International  Space  Station  and  Space  Shuttle  Mishap  Inter- 
agency Investigation  Board  be  renamed  the  Columbia  Acci- 
dent Investigation  Board.  O'Keefe  accepted  this  change  and 
fomially  chartered  the  Board  on  Sunday,  February  2,  2003. 

On  Sunday,  Board  members  flew  on  government  and  com- 
mercial aircraft  to  Barksdale  Air  Force  Base,  where  at  6:50 
p.m.  Central  Standard  Time  the  Board  held  its  first  official 
meeting.  The  Board  initiated  its  investigation  on  Monday, 
February  3,  at  8:00  a.m.  Central  Standard  Time.  On  Tuesday 
morning,  February  4,  the  Board  toured  the  debris  field  in 
and  around  Nacogdoches,  Texas,  and  observed  a  moment 
of  silence.  On  Thursday,  February  6,  the  Board  relocated  to 
the  Johnson  Space  Center,  eventually  settling  into  its  own 
offices  off  Center  grounds.  That  evening,  the  Board  formally 
relieved  the  NASA  Headquarters  Contingency  Action  Team 
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of  its  interim  responsibilities  for  initial  accident  investiga- 
tion activities.  The  Board  assumed  operational  control  of 
the  debris  search  and  recovery  efforts  from  NASA's  Mishap 
Investigation  Team,  which  functioned  under  the  Board's  di- 
rection until  the  completion  of  the  search  in  early  May. 

A. 2   Board  Charter  and 
Organization 

During  meetings  that  first  week.  Chairman  Gehman  and  the 
Board  proposed  that  its  charter  be  rewritten.  The  original 
charter,  derived  from  Appendix  D  of  NASA's  Contingency 
Action  Plan,  had  a  number  of  internal  inconsistencies  and 
provisions  that  the  Board  believed  would  impede  the  execu- 
tion of  its  duties.  Additionally,  the  Board  was  not  satisfied 
that  its  initial  charter  adequately  ensured  independence  from 
NASA.  The  Board  resolved  to: 

•  Have  its  own  administrative  and  technical  staff  so  that 
it  could  independently  conduct  testing  and  analysis  and 
establish  facts  and  conclusions 

•  Secure  an  adequate  and  independent  budget  to  be  over- 
seen by  the  Board  Chairman 

•  Establish  and  maintain  records  independent  from  NASA 
recoi'ds 

•  Empower  the  Board  Chairman  to  appoint  new  Board 
Members 

•  Provide  the  public  with  detailed  updates  on  the  progress 
of  its  investigation  through  frequent  public  hearings, 
press  briefings,  and  by  immediately  releasing  all  signifi- 
cant information,  with  the  exception  of  details  relating 
to  the  death  of  the  crew  members  and  privileged  witness 
statements  taken  under  the  condition  of  confidentiality 

•  Simultaneously  release  its  report  to  Congress,  the  White 
House,  NASA,  the  public,  and  the  astronauts'  families 

•  Allow  Board  members  to  voice  any  disagreements  with 
Board  conclusions  in  minority  reports 

With  the  full  cooperation  of  Administrator  O'Keefe,  the 
Board's  charter  was  rewritten  to  incorporate  these  prin- 
ciples. The  new  charter,  which  underwent  three  drafts,  was 
signed  and  ratified  by  O'Keefe  on  Februai7  18,  2003.  In 
re-chartering  the  Board,  O'Keefe  waived  the  requirements 
specified  in  the  Contingency  Action  Plan  that  the  Board  use 
standard  NASA  mishap  investigation  procedures  and  instead 
authorizeti  the  Board  to  pursue  "whatever  avenue  you  deem 
appropriate"  to  conduct  the  investigation.^ 

Additional  Board  Members 

To  manage  its  burgeoning  investigative  responsibilities,  the 
Board  added  additional  members,  each  of  whom  brought  to 
the  Board  a  needed  area  of  expertise.  On  February  6,  the 
Board  appointed  Roger  E.  Tetrault,  retired  Chairman  and 
Chief  Executive  Officer  of  McDermott  International.  On 
February  15,  the  Board  appointed  Sheila  E.  Widnall,  Ph.D., 
Institute  Professor  and  Professor  of  Aeronautics  and  Astro- 
nautics at  the  Massachusetts  Institute  of  Technology  and 
former  Secretary  of  the  Air  Force.  On  March  5,  the  Board 
appointed  Douglas  D.  Osheroff,  Ph.D.,  Nobel  Laureate  in 
Physics  and  Chair  of  the  Stanford  Physics  Department;  Sally 
K.  Ride,  Ph.D.,  Professor  of  Space  Science  at  the  University 


of  California  at  San  Diego  and  the  nation's  first  woman  in 
space;  and  John  M.  Logsdon,  Ph.D.,  Director  of  the  Space 
Policy  Institute  at  George  Washington  University.  This 
brought  the  total  number  of  Board  members  to  13,  coinci- 
dental ly  the  same  number  as  the  Presidential  Commission 
on  the  Space  Shuttle  Cluillciiiier  Accident. 

Board  OrganizaHon 

In  the  first  week,  the  Board  divided  into  four  groups,  each  of 
which  addressed  separate  areas  of  the  investigation.  Group 
I,  consisting  of  General  Barry,  General  Deal,  and  Admiral 
Turcotte,  examined  NASA  management  and  treatment  of 
materials,  including  Shuttle  maintenance  safety  and  mis- 
sion assurance.  Group  II,  consisting  of  General  Hess.  Mr. 
Wallace,  and  later  Dr.  Ride,  scrutinized  NASA  training, 
operations,  and  the  in-flight  performance  of  ground  crews 
and  the  Shuttle  crew.  Group  III,  consisting  of  Dr.  Hallock, 
Mr.  Hubbard,  and  later  Mr.  Tetrault,  Dr.  Widnall,  and  Dr. 
Osheroff,  focused  on  engineering  and  technical  analysis  of 
the  accident  and  resulting  debris.  Group  IV,  consisting  of  Dr. 
Logsdon,  Dr.  Ride,  and  Mr.  Hubbard,  examined  how  NASA 
history,  budget,  and  institutional  culture  affected  the  opera- 
tion of  the  Space  Shuttle  Program.  Each  group,  with  the  ap- 
proval of  the  Chairman,  hired  investigators  and  supprart  staff 
and  collaborated  extensively  with  one  another. 

The  Board  also  organized  an  internal  staff  of  technical  ex- 
perts called  the  Independent  Assessment  Team.  Under  the 
leadership  of  .lames  Mosquera,  a  senior  nuclear  engineer 
with  the  U.  S.  Navy,  the  Independent  Assessment  Team  ad- 
vised the  Board  when  and  where  NASA  analysis  should  be 
independently  verified  and,  when  needed,  conducted  fully 
independent  tests  on  the  Board's  behalf. 

A. 3   Investigation  Process  and  Scope 

Decision  to  Pursue  a  Safety  Investigation 

During  the  first  week  of  its  investigation,  the  Board  reviewed 
the  stiTJCture  and  methodology  of  the  Presidential  Commis- 
sion on  the  Space  Shuttle  Challenger  Accident,  the  Interna- 
tional Civil  Aviation  Organization  standards  used  by  the  Na- 
tional Transportation  Safety  Board  and  the  Federal  Aviation 
Administration,  and  the  accident  investigation  models  under 
which  the  U.S.  Air  Force  and  Navy  Safety  Centers  operate. 
Rather  than  assign  formal  blame  or  determine  legal  liability 
for  the  cause  of  the  accident,  the  Board  affirmed  its  charge  to 
pursue  both  an  accident  investigation  and  a  safety  investiga- 
tion, the  primary  aim  of  which  would  be  to  identify  and  cor- 
rect threats  to  the  safe  operation  of  the  Space  Shuttle. 

The  Use  of  Privileged  Witness  Statements 

With  a  principal  focus  on  identifying  and  correcting  threats 
to  safe  operations,  safety  investigations  place  a  premium  on 
obtaining  full  and  complete  disclosure  about  every  aspect  of 
an  accident,  even  if  that  information  may  prove  damaging 
or  embarrassing  to  particular  individuals  or  organizations. 
However,  individuals  who  have  made  mistakes,  know  of 
negligence  by  others,  or  suspect  potential  flaws  in  their  or- 
ganizations are  often  afraid  of  being  fired  or  even  prosecuted 


r  s  T     2  a  D  3 


COLUMBIA 

ACCIDENT  INVESTIGATIDN  BOARD 


if  they  speak  out.  To  allay  these  fears,  which  can  prevent  the 
emergence  of  information  that  could  save  lives  in  the  future, 
many  safety  investigations,  including  those  by  NASA  and 
by  the  Air  Force  and  Navy  Safety  Centers,  grant  witnesses 
complete  confidentiality,  as  do  internal  affairs  investigations 
by  agency  Inspector  Generals.  This  confidentiality,  which 
courts  recognize  as  "privileged  communication,"  allows 
witnesses  to  volunteer  information  that  they  would  not 
otherwise  provide  and  to  speculate  more  openly  about  their 
organizations'  flaws  than  they  would  in  a  public  forum. 

Given  the  stakes  of  the  Columbia  accident  investigation,  the 
most  important  being  the  lives  of  future  astronauts,  the  Board 
decided  to  extend  witnesses  confidentiality,  even  though  this 
confidentiality  would  necessitate  that  investigators  redact 
some  witness  information  before  releasing  it  to  the  public. 

Consistent  with  NASA  Safety  Program  policy  NPD  862 1 . 1 H 
Para  I  .j,  statements  made  to  Board  investigators  under  privi- 
lege were  not  made  under  legal  oath.  Investigators  recorded 
and  then  transcribed  interviews,  with  those  interviewed  af- 
firming by  their  signatures  the  accuracy  of  the  transcripts. 
The  Board  took  extraordinary'  measures  to  ensure  that 
privileged  witness  statements  would  remain  confidential  by 
restricting  access  to  these  statements  to  its  13  members  and 
a  small  number  of  authorized  support  staff.  Witness  state- 
ments and  information  derived  from  them  are  exempt  from 
disclosure  under  the  Freedom  of  Information  Act. 

The  existence  of  a  safety  investigation  in  which  privileged 
statements  are  taken  does  not  prevent  an  accounting  of  per- 
sonal responsibility  associated  with  an  accident.  It  merely 
means  that  such  an  accounting  must  result  from  a  separate 
investigation,  in  this  instance,  that  responsibility  has  been 
left  to  the  NASA  administration  and  the  Congressional  com- 
mittees that  oversee  the  agency.  To  facilitate  this  separate 
investigation,  the  Board  pledged  to  notify  NASA  and  Con- 
gress if  evidence  of  criminal  activity  or  willful  negligence  is 
found  in  privileged  statements  or  elsewhere.  Additionally, 
the  Board  opened  all  its  files  to  Congressional  representa- 
tives, with  the  exception  of  privileged  witness  statements. 
Limited  Congressional  access  to  these  statements  is  gov- 
erned by  a  special  written  agreement  between  the  oversight 
committees  and  the  Board  that  preserves  the  Board's  obliga- 
tion to  witnesses  who  have  entrusted  them  with  information 
on  the  condition  of  confidentiality. 

Expanded  Bounds  of  Board  Investigation 

Throughout  the  investigation,  Chairman  Gehman  consulted 
regularly  with  members  of  Congress  and  the  Administration 
tf)  ensure  that  the  Board  met  its  responsibilities  to  provide 
the  public  with  a  full  and  open  accounting  of  the  Colitmhia 
accident.  At  the  request  of  Congressional  Oversight  Com- 
mittees, the  Board  significantly  expanded  the  scope  of  its 
investigation  to  include  a  broad  review  of  the  Space  Shuttle 
Program  since  its  inception.  In  addition  to  establishing  the 
accident's  probable  and  contributing  cau.ses,  the  Board's  re- 
port is  intended  to  serve  as  the  basis  for  an  extended  public 
policy  debate  over  the  future  course  of  the  Space  Shuttle 
Program  and  the  role  it  will  play  in  the  nation's  manned 
space  flight  program. 


A. 4   Board  Policies  and  Procedures 

Authorizing  Investigators 

To  maintain  control  over  the  investigation  process,  the  Chair- 
man established  a  system  of  written  authorizations  specify- 
ing individuals  who  were  sanctioned  to  interview  witnesses 
or  perform  other  functions  on  behalf  of  the  Board. 

Consideration  of  Federal  Advisory  Committee  Act 
Statutes 


Not  long  after  its  activation,  and  well  before  adding  addi- 
tional members,  the  Board  considered  the  applicability  of 
the  Federal  Advisory  Committee  Act.'  This  statute  requires 
advisory  committees  established  by  the  President  or  a  fed- 
eral agency  to  provide  formal  public  notice  of  their  meet- 
ings as  well  as  public  access  to  their  deliberations.  In  con- 
trast to  most  committees  governed  by  the  Federal  Advisory 
Committee  Act.  which  meet  a  few  times  per  year,  the  Board 
intended  from  the  outset  to  conduct  a  full-time,  fast-paced 
investigation,  in  which  Board  members  themselves  were 
active  investigators  who  would  shape  the  investigation's 
direction  as  it  developed.  The  Board  concluded  that  the 
formalities  required  by  the  Federal  Advisory  Committee 
Act  are  not  compatible  with  the  kind  of  investigation  it  was 
charged  to  complete.  Nor  did  the  Board  find  the  Federal 
Advisoiy  Committee  Act  statutes  compatible  with  exercis- 
ing operational  responsibility  for  more  than  a  hundred  staff 
and  thousands  of  debris  searchers. 

Though  the  Federal  Advisory  Committee  Act  did  not  apply 
to  the  Board's  activities,  the  Board  resolved  to  be  faithful  to 
the  standards  of  openness  the  .Act  embodies.  The  Board  held 
frequent  press  briefings  and  public  hearings,  released  all  sig- 
nificant findings  immediately,  and  maintained  a  telephone 
hotline  and  a  Web  site,  where  users  accessed  Web  pages 
more  than  40,000,000  times.  The  Board  also  processed 
Freedom  of  Infonnation  Act  requests  according  to  proce- 
dures established  in  14  C.F.R.  Section  1206. 

Board  Members  as  Federal  Employees 

The  possibility  of  litigation  against  Board  members  for 
their  actions  while  on  the  Board,  especially  becau.se  the 
Space  Flight  Operations  Contract  would  be  a  subject  of 
investigation,  made  it  necessary  to  bring  Board  Members 
within  the  protections  that  the  Federal  Tort  Claims  Act  af- 
fords to  federal  employees.  This  and  other  considerations 
led  the  Board  Chairman  to  determine  that  the  Board  should 
consist  of  full-time  federal  employees.  As  the  Chairman 
named  new  Board  members,  the  NASA  Administrator  hon- 
ored the  Board's  determination  and  deemed  them  full-time 
federal  employees. 

Oversight  of  Board  Activities 

To  ensure  that  the  Board  acted  in  an  independent  and  unbi- 
a,sed  manner  in  its  investigation,  the  NASA  Inspector  Gener- 
al was  admitted  on  request  to  any  Board  proceeding,  except 
those  involving  privileged  witness  statements.  The  Board 
also  allowed  Congressional  access  to  the  Board's  databases 
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and  offices  in  Houston  and  Washington,  D.C.,  with  special 
restrictions  that  preserved  the  integrity  and  confidentiality  of 
privileged  witness  statements. 

Financial  Independence 

To  ensure  the  Board's  financial  independence,  NASA  estab- 
lished a  separate  operating  budget  for  the  Board's  activities. 
This  fund  provided  for  Board  operating  expenses,  including 
extensive  testing  and  analysis  and  the  acquisition  of  services 
by  support  staff  and  technical  experts.  With  the  exception 
of  Chairman  Gehman,  whose  salary  was  paid  by  the  Office 
of  Personnel  Management,  and  those  Board  members  who 
were  already  federal  government  or  military  employees. 
Board  members  were  compensated  by  Congressionally  ap- 
propriated funds  administered  by  NASA. 

Board  Staffing  and  Administrative  Support 

Through  a  Government  Services  Administration-supervised 
bidding  process,  Valador,  Inc.,  a  service-disabled-veteran- 
ovvned  professional  services  contractor,  was  selected  to 
provide  the  Board's  administrative  and  technical  support. 
Under  a  Mission  Operation  and  Business  Improvement 
Systems  contract,  Valador  arranged  for  the  Board's  support 
staff,  technical  experts,  and  information  technology  needs, 
including  the  Board  Web  site,  http://viu\c.(<//7>.;/.s.  Valador 
also  supported  the  Board's  public  hearings,  press  confer- 
ences, the  public-input  database,  and  the  publication  of  the 
final  report. 

The  Board  was  aided  by  public  affairs  officers;  a  budget 
manager;  representatives  from  the  National  Transportation 
Safety  Board,  Federal  Emergency  Management  Agency, 
Department  of  Defense,  and  the  Department  of  Justice  Civil 
Division,  Office  of  Litigation  Support;  and  Dr.  James  B. 
Bagian,  an  astronaut  flight  surgeon  assigned  from  the  De- 
partment of  Veterans  Affairs  who  worked  with  the  NASA 
medical  staff.  Armed  Forces  Institute  of  Pathology,  and  the 
local  medical  examiner.  A  complete  list  of  staff  and  consul- 
tants appears  in  Appendix  B.2  and  B.3. 

Public  Inputs 

The  Board  established  a  system  for  inputs  from  the  public 
that  included  a  24-hour  hotline,  mailing  address,  and  online 
comment  form  linked  to  the  Board's  Web  site.  This  enabled 
the  submission  of  pheitographs,  comments,  technical  papers, 
and  other  materials  by  the  public,  some  of  whom  made  sub- 
missions anonymously.  Board  staff  logged  every  input  into 
a  database.  To  establish  the  relevance  of  every  phone  call, 
letter,  e-mail,  or  online  comment,  investigators  evaluated 
their  significance  and,  if  appropriate,  followed  up  with  the 
submitters.  Of  the  3,0(X)  submissions  the  Board  received, 
more  than  750  resulted  in  actions  by  one  of  the  Board's 
four  investigative  sub-groups,  the  Independent  Assessment 
Team,  or  other  Board  staff. 

Office  of  Governmental  Affairs 

As  inquiries  from  Congress  grew  and  the  need  to  keep 
the  Executive  and  Legislative  branches  updated  on  the 


investigation's  progress  became  clear,  the  Board  opened  an 
Office  of  Governmental  Affairs.  Based  in  Washington,  D.C., 
it  served  as  the  Board's  liaison  to  the  White  House,  depart- 
ments within  the  Executive  Branch,  Congressional  Oversight 
Committees,  and  members  of  Congress  and  their  staffs.  The 
office  conducted  numerous  briefings,  responded  to  Congres- 
sional inquiries,  and  ensured  that  the  investigation  met  the 
needs  of  the  Congressional  Oversight  Committees  that  plan 
to  use  the  Board's  report  as  the  basis  for  a  public  policy  de- 
bate on  the  future  of  the  Space  Shuttle  Program. 

A. 5   Investigation  Interface  with  NASA 

NASA  mobilized  hundreds  of  personnel  to  directly  support 
the  Board's  investigation  on  a  full-time  basis.  Initially,  as 
part  of  the  Contingency  Action  Plan  activated  on  February 
I,  the  Mishap  Investigation  Team  went  to  Barksdale  Air 
Force  Base  to  coordinate  the  search  for  debris.  NASA  then 
deployed  a  Mishap  Response  Team  to  begin  an  engineering 
analysis  of  the  accident.  These  groups  consisted  of  Space 
Shuttle  Program  personnel  and  outside  experts  from  NASA 
and  contractor  facilities. 

As  prescribed  by  its  charter,  the  Board  coordinated  its  in- 
vestigation with  NASA  through  a  NASA  Task  Force  Team, 
later  designated  the  Columbia  Task  Force.  This  group  was 
the  liaison  between  the  Board  and  the  Mishap  Response 
Team.  As  the  investigation  progressed,  NASA  modified  the 
organizational  structure  of  the  Mishap  Response  Team  to 
more  clo.sely  align  with  Board  structure  and  investigative 
paths,  and  NASA  renamed  it  the  NASA  Accident  Investiga- 
tion Team.  This  team  supported  the  Board's  investigation, 
along  with  thousands  of  other  NASA  and  contract  personnel 
who  worked  in  the  fault  tree  teams  described  in  Chapter  4 
and  on  the  debris  search  efforts  described  in  Chapter  2. 

Documents  and  Actions  Requested  From  NASA 

The  close  coordination  of  the  NASA  Investigation  Team  with 
the  Board's  sub-groups  required  a  system  for  tracking  docu- 
ments and  actions  requested  by  the  investigation.  The  Board 
and  the  Columbia  Task  Force  each  appointed  representatives 
to  track  documents  and  manage  their  configuration. 

Board  investigators  submitted  more  than  600  requests  for 
action  or  information  from  NASA.  Requests  were  submitted 
in  writing,  on  a  standardized  form,^  and  signed  by  a  Board 
member.  Only  Board  members  were  authorized  to  sign  such 
requests.  Each  request  was  given  a  priority  and  tracked  in  a 
database.  Once  answered  by  Columbia  Task  Force  person- 
nel, the  Board  member  who  submitted  the  request  either 
noted  by  signature  that  the  response  was  satisfactory  or  re- 
submitted the  request  for  further  action. 

Reassignment  of  Certain  NASA  Personnel  Involved 
in  STS-107 

On  February  25,  2003,  Chairman  Gehman  wrote  to  NASA 
Administrator  O'Keefe,  asking  that  he  "reassign  the  top 
level  Space  Shuttle  Program  management  personnel  who 
were  involved  in  the  preparation  and  operation  of  the  flight 
of  .STS-107  back  to  their  duties  and  remove  them  from  di- 
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rectly  managing  or  supporting  the  investigation."^  This  letter 
expressed  the  Board's  desire  to  prevent  actual  or  perceived 
conflicts  of  interest  between  NASA  personnel  and  the  inves- 
tigation. In  response,  O'Keefe  reassigned  several  members 
of  NASA's  Columbia  Task  Force  and  Mishap  Investigation 
Team  and  reorganized  it  along  the  same  lines  as  the  Board's 
groups.  Additionally.  Bryan  O'Connor,  an  Ex-Officio  Mem- 
ber to  the  Board,  and  Theron  Bradley  Jr.,  the  Board's  Execu- 
tive Secretary,  returned  to  their  respective  duties  as  Associate 
Administrator  for  Safety  and  Mission  Assurance  and  Chief 
Engineer,  and  were  not  replaced.  After  O'Connor's  depar- 
ture. Colonel  (Selectee)  Michael  J.  Bloomfield,  an  active 
Shuttle  Commander  and  the  lead  training  astronaut,  joined 
the  Board  as  a  representative  from  the  Astronaut  Office. 

Handling  of  Debris  and  Impounded  Materials 

To  ensure  that  all  material  associated  with  Columbia's  mis- 
sion was  preserved  as  evidence  in  the  investigation.  NASA 
officials  impounded  data,  software,  hardware,  and  facilities 
at  NASA  and  contractor  sites.  At  the  Johnson  Space  Center 
in  Houston,  Texas,  the  door  to  the  Mission  Control  Center 
was  locked  while  flight  control  personnel  created  and  ar- 
chived backup  copies  of  all  original  mission  data  and  took 
statements  from  Mission  Control  personnel.  .At  the  Ken- 
nedy Space  Center  in  Florida,  mission  facilities  and  related 
hardware,  including  Launch  Pad  Complex  39-A,  were  put 
under  guard  or  stored  in  secure  warehouses.  Similar  steps 
were  taken  at  other  key  Shuttle  facilities,  including  the  Mar- 
shall Space  Flight  Center  in  Huntsville,  Alabama,  and  the 
Michoud  Assembly  Facility  near  New  Orleans,  Louisiana. 
Impounded  items  and  data  were  released  only  when  the 
Board  Chairman  approved  a  formal  request  from  the  NASA 
Columbia  Task  Force. 

Similarly,  any  testing  performed  on  Shuttle  debris  was  ap- 
proved by  the  Board  Chairman  only  after  the  Columbia  Task 
Force  provided  a  written  request  outlining  the  potential  ben- 
efits of  the  testing  and  addressing  any  possible  degradation  of 
the  debris  that  could  affect  the  investigation.  When  testing  of 
Shuttle  debris  or  hardware  occurred  outside  the  secure  debris 
hanger  at  the  Kennedy  Space  Center,  investigation  personnel 
escorted  the  debris  for  the  duration  of  the  testing  process  or 
otherwise  ensured  the  items'  integrity  and  security. 

A. 6   Board  Documentation  System 

The  Columbia  Accident  Investigation  Board 
Database  Server 

The  sheer  volume  of  documentation  and  research  generated 
in  the  investigation  required  an  electronic  repository  capable 
of  storing  hundreds  of  thousands  of  pages  of  technical  in- 
formation, briefing  charts,  hearing  transcripts,  government 
documents,  witness  statements,  public  inputs,  and  corre- 
spondence related  to  the  Coltimhia  accident. 

For  the  first  few  months  of  its  investigation,  the  Board  used 
the  Process-Based  Mission  Assurance  (PBMA)  system 
for  many  of  its  documentation  needs.  This  Web-based  ac- 
tion tracking  and  document  management  system,  which  is 
hosted  on  a  server  at  the  NASA  Glenn  Research  Center, 


was  developed  and  maintained  by  NASA  Ames  Research 
Center.  The  PBMA  system  was  established  as  a  repository 
for  all  data  provided  by  NASA  in  response  to  the  Board's 
Action/Request  for  Information  process.  It  contained  all  in- 
formation produced  by  the  Columbia  Task  Force,  as  well  as 
reports  from  NASA  and  other  external  groups,  presentations 
to  the  Board,  signed  hardware  release  and  test  release  forms, 
images,  and  schedule  information. 

However,  the  PBMA  system  had  several  critical  limita- 
tions that  eventually  compelled  the  Board  to  establish  its 
own  server  and  databases.  First.  NASA  owned  the  Mission 
Assurance  system  and  was  responsible  for  the  documents 
it  produced.  The  Board,  seeking  to  maintain  independence 
from  NASA  and  the  Columbia  Task  Force,  found  it  unac- 
ceptable to  keep  its  documentation  on  what  was  ultimately  a 
NASA  database.  Second,  the  PBMA  system  is  not  full-text 
searchable,  and  did  not  allow  investigators  to  efficiently 
cross-reference  documents. 

The  Board  wanted  access  to  all  the  documents  produced  by 
the  Columbia  Task  Force,  while  simultaneously  maintaining 
its  own  secure  and  independent  databases.  To  accomplish 
this,  the  Board  secured  the  assistance  of  the  Department  of 
Justice  Civil  Division,  Office  of  Litigation  Support,  which 
established  the  Columbia  Accident  Investigation  Board  Da- 
tabase Server  This  server  provided  access  to  four  document 
databases: 

•  Columbia  Task  Force  Database:  all  the  data  in  NASA's 
Process-Based  Mission  Assurance  system,  though  inde- 
pendent from  it. 

•  Columbia  Accident  Investigation  Board  Document  Da- 
tabase: all  documents  gathered  or  generated  by  Board 
members,  investigators,  and  support  staff. 

•  Interview  Database:  all  transcriptions  of  privileged  wit- 
ness interviews. 

•  Investigation  Meeting  Minutes  Database:  text  of  ap- 
proved Board  meeting  minutes. 

Although  the  Board  had  access  to  the  Process-Based  Mis- 
sion Assurance  system  and  therefore  every  document  cre- 
ated by  the  Columbia  Task  Force,  the  Task  Force  did  not 
have  access  to  any  of  the  Board's  documents  that  were 
independently  produced  in  the  Board's  four  other  databases. 
A  security  system  allowed  Board  members  to  access  these 
databases  through  the  Board's  Database  Server  using  confi- 
dential IDs  and  passwords.  In  total,  the  Columbia  Accident 
Investigation  Board  Database  Server  housed  more  than 
450,000  pages  that  comprised  more  than  75,000  documents. 
The  bulk  of  these  are  from  NASA's  Columbia  Task  Force 
Document  Database,  which  holds  over  45,000  documents 
totaling  270,000  pages. 

To  ensure  that  all  documents  received  and  generated  by 
individual  investigators  became  part  of  the  permanent  Co- 
lumbia Accident  Investigation  Board  archive.  Department 
of  Justice  contractors  had  coordinators  in  each  investigative 
group  who  gathered  electronic  or  hard  copies  of  all  relevant 
investigation  documents  for  inclusion  in  the  Columbia 
Accident  Investigation  Board  Document  Database.  Every 
page  of  hard  copy  received  a  unique  tracking  number,  was 
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imaged,  converted  to  a  digital  format,  and  loaded  onto  the 
server.  Documents  submitted  electronically  were  saved  in 
Adobe  PDF  format  and  endorsed  with  a  tracking  number 
on  each  page.  Where  relevant,  these  document  numbers  are 
referenced  in  citations  found  in  this  report.  The  Columbia 
Accident  Investigation  Board  Document  database  contains 
more  than  30,000  documents  comprising  1 80,000  pages. 

Other  significant  holdings  on  the  Columbia  Accident  In- 
vestigation Board  Document  Database  Server  include  the 
interview  Database,  which  holds  287  documents  compris- 
ing 6. .300  pages,  and  the  Investigative  Meeting  Minutes 
Database,  which  holds  72  documents  totaling  598  pages. 

Concordance 

Acting  on  the  recommendation  of  the  Department  of  Justice, 
the  Board  selected  Concordance  as  the  software  to  manage 
all  the  electronic  documents  on  the  Columbia  Accident 
Investigation  Board  Database  Server.  Concordance  is  a 
full-text,  image-enabled  document  and  transcript  database 
accessible  to  authorized  Board  members  on  their  office  com- 
puters. Concordance  allowed  the  Board  to  quickly  search  the 
data  provided  by  the  Columbia  Task  Force,  as  well  as  any 
documents  created  and  stored  in  the  four  other  databases. 
The  Concordance  application  was  on  a  server  in  a  secure 
location  in  the  Board  office.  Though  connected  to  the  John- 
son Space  Center  backbone,  it  was  exclusively  managed  and 
administered  by  the  Department  of  Justice  and  contract  staff 
from  Aspen  Systems  Corporation.  Department  of  Justice 
and  contract  staff  trained  users  to  search  the  database,  and 
performed  searches  at  the  request  of  Board  members  and 
investigators.  The  Department  of  Justice  and  contract  staff 
also  assisted  Congressional  representatives  in  accessing  the 
Columbia  Accident  Investigation  Board  Database  Server. 

Investigation  Database  Tools 

In  addition  to  these  databases,  several  information  manage- 
ment tools  aided  the  Board's  investigation,  deliberation,  and 
report  writing. 

Group  Systems 

Group  Systems  is  a  collaborative  software  tool  that  orga- 
nizes ideas  and  information  by  narrowing  in  on  key  issues 
and  possible  solutions.  It  supports  academic,  government, 
and  commercial  organizations  worldwide.  The  Board  used 
Group  Systems  primarily  to  brainstorm  topics  for  inclusion 
in  the  report  outline  and  to  classify  information  related  to 
the  accident. 

Investigation  Organizer 

Investigation  Organizer  is  a  Web-based  pre-decisional 
management  and  modeling  tool  designed  by  NASA  to  sup- 
port mishap  investigation  teams.  Investigation  Organizer 
provides  a  central  information  repository  that  can  be  used 
by  investigation  teams  to  store  digital  products.  The  Board 
used  Investigation  Organizer  to  connect  data  from  various 
sources  to  the  outline  that  guided  its  investigation.  Inves- 
tigation Organizer  was  developed,  maintained,  and  hosted 


by  NASA  Ames  Research  Center.  Access  to  Board  files  on 
Investigation  Organizer  was  restricted  to  Board  members 
and  authorized  staff. 

Tech  Doc 

The  Board  drafted  its  final  report  with  the  assistance  of 
Tech  Doc,  a  secure  Web-based  file  management  program 
that  allowed  the  13  Board  members  and  the  editorial  staff 
to  comment  on  report  drafts.  TechDoc  requires  two-factor 
authentication  and  is  certified  to  store  sensitive  Shuttle  engi- 
neering data  that  is  governed  by  the  International  Traffic  in 
Amis  Reduction  Treaty. 

Official  Photographer 

The  Board  employed  an  official  photographer,  who  took 
more  than  5,000  digital  images.  These  photographs,  many 
of  which  have  been  electronically  edited,  document  Board 
members  and  support  staff  at  work  in  their  offices  and  in  the 
field  in  Te.xas,  Florida,  Alabama,  Louisiana,  and  Washing- 
ton, D.C.;  at  Shuttle  debris  collection,  analysis,  and  testing; 
and  at  public  hearings,  press  briefings,  and  Congressional 
hearings.  Images  captured  by  NASA  photographers  relevant 
to  the  investigation  are  available  through  NASA's  Public 
Affairs  Office. 

National  Archives  and  Records  Administration 

All  appropriate  Board  documentation  and  products  will  be 
stored  for  submission  to  the  National  Archives  and  Records 
Administration,  with  the  exception  of  documents  originating 
in  the  Process-Based  Mission  Assurance  system,  which  will 
be  archived  by  NASA  under  standard  agency  procedures. 
Representatives  of  the  Board  will  review  all  documentation 
prior  to  its  transfer  to  the  National  Archives  to  safeguard 
privacy  and  national  security.  This  preparation  will  include  a 
review  of  all  documents  to  ensure  compliance  with  the  Free- 
dom of  Infomiation  Act.  the  Trade  Secrets  Act,  the  Privacy 
Act,  the  International  Traffic  in  Arms  Reduction  Treaty,  and 
Export  Administration  Regulations.  To  gain  access  to  the 
Board's  documents,  requests  can  be  made  to: 

National  Archives  and  Records  Administration 

Customer  Services  Division  (NWCC) 

Room  2400 

8601  Adelphi  Road 

College  Park,  MD  20740-601 1 

The  National  Archives  and  Records  Administration  can  be 
contacted  at  301.837.3130.  More  infomiation  is  available  at 
http://www.nara.gov. 
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The  Board  held  public  hearings  to  listen  to  and  question  expert  witnesses.  A  list  of  these  hearings,  and  the  participating  wit- 
nesses, follows;  transcripts  of  the  hearings  are  available  in  Appendix  G. 

March  6,  2003  Houston,  Texas 

Review  of  NASA's  Organizational  Structure  and  Recent  Space  Shuttle  History 

Lt.  Gen.  Jefferson  D.  Howell,  Jr.  Director.  NASA  Johnson  Space  Center 

Mr  Ronald  D.  Dittemore,  Manager.  Space  Shuttle  Program 

Mr  Keith  \.  Chong.  Engineer.  Boeing  Corporation 

Dr  Harry  McDonald,  Professor,  University  of  Tennessee 

March  17,  2003,  Houston,  Texas 

Columbia  Re-entry  Telemetry  Data,  and  Debris  Dispersion  Timeline 

Mr  Paul  S.  Hill,  Space  Shuttle  and  International  Space  Station  Flight  Director,  NASA  Johnson  Space  Center 

Mr  R.  Douglas  White.  Director  for  Operations  Requirements.  Orbiter  Element  Department.  United  Space  Alliance 

Prior  Orbital  Debris  Re-entry  Data 

Dr.  William  H.  Ailor.  Director,  Center  for  Orbital  and  Re-entry  Debris  Studies,  The  Aerospace  Corporation 

March  18,  2003,  Houston,  Texas 

Aero  and  Thermal  Analysis  of  Columbia  Re-entry  Data 

Mr  Jose  M.  Caram.  Aerospace  Engineer.  Aeroscience  and  Flight  Mechanics  Division.  NASA  Johnson  Space  Center 

Mr  Steven  G.  Labbe.  Chief,  Applied  Aeroscience  and  Computational  Fluid  Dynamics  Branch,  NASA  Johnson  Space  Center 

Dr.  John  J.  Bertin,  Professor  of  Aerodynamics,  United  States  Air  Force  Academy 

Mr  Christopher  B.  Madden.  Deputy  Chief.  Thermal  Design  Branch,  NASA  Johnson  Space  Center 

March  25,  2003,  Cape  Canaveral,  Florida 

Launch  Safety  Considerations 

Mr  Roy  D.  Bridges,  Jr,  Director.  Kennedy  Space  Center 

Role  of  the  Kennedy  Space  Center  in  the  Shuttle  Program 

Mr  William  S.  Higgins,  Chief  of  Shuttle  Processing  Safety  and  Mission  Assurance  Division.  Kennedy  Space  Center 
Lt.  Gen.  Aloysius  G.  Casey.  U.S.  Air  Force  (Retired) 

March  26,  2003,  Cape  Canaveral,  Florida 

Debris  Collection,  Layout,  and  Analysis,  including  Forensic  Metallurgy 

Mr  Michael  U.  Rudolphi.  Deputy  Director,  Stennis  Space  Center 

Mr  Steven  J.  Altemus,  Shuttle  Test  Director,  Kennedy  Space  Center 

Dr  Gregory  T  A.  Kovacs,  Associate  Professor  of  Electronics,  Stanford  University 

Mr  G.  Mark.  Tanner,  Vice  President  and  Senior  Consulting  Engineer,  Mechanical  &  Materials  Engineering 

April  7,  2003,  Houston,  Texas 

Post-Flight  Analysis,  Flight  Rules,  and  the  Dynamics  of  Shedding  Foam  from  the  External  Tank 

Col.  James  D.  Halsell,  Jr.  U.S.  Air  Force.  NASA  Astronaut.  NASA  Johnson  Space  Center 

Mr.  Robert  E.  Castle.  Jr,  Chief  Engineer.  Mission  Operations  Directorate.  NASA  Johnson  Space  Center 

Mr  J.  Scott  Sparks,  Department  Lead,  External  Tank  issues,  NASA  Marshall  Space  Flight  Center 

Mr  Lee  D.  Foster,  Technical  Staff.  Vehicle  and  Systems  Development  Department,  NASA  Marshall  Space  Flight  Center 
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April  8,  2003,  Houston,  Texas 

Shuttle  Safety  Concerns,  Upgrade  Issues,  and  Debris  Strikes  on  the  Orbiter 

Mr.  Richard  D.  Blomberg,  Former  Chairman,  NASA  Aerospace  Safety  Advisory  Panel 

Mr.  Daniel  R.  Bell,  Thermal  Protection  System  Sub-System  Manager  for  the  Boeing  Company  at  Kennedy  Space  Center 

Mr.  Gary  W.  Grant.  Systems  Engineer  in  the  Thermal  Management  Group  for  the  Boeing  Company  at  Kennedy  Space  Center 

April  23,  2003,  Houston,  Texas 

Tradeoffs  Made  During  the  Shuttle's  Initial  Design  and  Development  Period 

Dr.  Milton  A.  Silveira.  Technical  Advisor  to  the  Program  Director,  Missile  Defense  Agency,  Office  of  the  Secretary  of  Defense 

Mr.  George  W.  Jeffs,  Retired  President  of  Aerospace  and  Energy  Operations.  Rockwell  International  Corporation 

Prof.  Aaron  Cohen,  Professor  Emeritus  of  Mechanical  Engineering,  Texas  A&M  University 

Mr.  Owen  G.  Morris,  Founder,  CEO,  and  Chairman  of  Eagle  Aerospace,  Inc. 

Mr.  Robert  F.  Thompson,  former  Vice  President  of  the  Space  Station  Program  for  McDonnell  Douglas 

Managing  Aging  Aircraft 

Dr.  Jean  R.  Gebman.  Senior  Engineer.  RAND  Corporation 

Mr.  Robert  P  Ernst.  Head  of  the  Aging  Aircraft  Program,  Naval  Air  Systems  Command 

Risk  Assessment  and  Management  in  Complex  Organizations 

Dr.  Diane  Vaughan.  Professor.  Department  of  Sociology  at  Boston  College 

May  6,  2003,  Houston,  Texas 

MADS  Timeline  Update,  Ascent  Video 

Dr.  Gregory  J.  Byrne.  Assistant  Manager,  Human  Exploration  Science.  Astromaterials  Research  and  Exploration  Science  Of- 
fice at  the  Joiinson  Space  Center 

Mr.  Steven  Rickman.  Chief  of  the  Thermal  Design  Branch.  Johnson  Space  Center.  NASA 
Dr.  Brian  M.  Kent.  Air  Force  Research  Laboratory  Research  Fellow 

David  \V.  Whittle,  Chairman  of  the  Systems  Safety  Review  Panel  and  Chairman  of  the  Mishap  Investigation  Team  in  the 
Shuttle  Program  Office 

June  12,  2003,  Washington,  DC 

NASA  Budgetary  History  and  Shuttle  Program  Management 

Mr.  Allen  Li,  Director,  Acquisition  and  Sourcing  Management,  General  Accounting  Office 

Ms.  Marcia  S.  Smith,  Specialist  in  Aerospace  and  Telecommunications  Policy,  Congressional  Research  Service 

Mr.  Rus.sell  D.  Turner,  Former  President  and  CEO,  United  Space  Alliance 

Mr.  A.  Thomas  Young,  Retired  Aerospace  Executive 


Endnotes  for  Appendix  A 


'  NASA  Agency  Contingency  Action  Plan  for  Space  Flight  Operations,  January  2003,  p.  D-2. 

"  Guidelines  per  NASA  Policy  Guideline  8621. 

'SU.S.C.  App§§l  efseq.  (1972). 

^JSC  Form  564  (March  24,  2003). 

'  Harold  W.  Gehmon  to  Sean  O'Keefe,  February  25,  2003. 
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Admiral  Harold  W.  Gehman  Jr.  (Retired) 

Chairman,  Columbia  Accident  Investigation  Board.  Formerly  Co-Chairman  of  the  Department  of 
Defense  review  of  the  attack  on  the  U.S.S.  Cole.  Before  retiring,  Gehman  served  as  the  NATO 
Supreme  Allied  Commander,  Atlantic.  Commander  in  Chief  of  the  U.S.  Joint  Forces  Command, 
and  Vice  Chief  of  Naval  Operations  for  the  U.S.  Navy.  Gehman  earned  a  B.S.  in  industrial  Engi- 
neering from  Penn  State  University  and  is  a  retired  four  star  Admiral. 


Major  General  John  L.  Barry 

Executive  Director  for  the  Columbia  Accident  Investigation.  Director,  Plans  and  Programs, 
Headquarters  Air  Force  Materiel  Command,  Wright-Patterson  Air  Force  Base,  Ohio.  An  honors 
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MR.  MAHONE:  Good  morning,  and  thank  you  for  joining 
us  here  in  Washington  and  from  the  centers  across  the 
country  at  our  various  NASA  field  centers.  Before  I  intro- 
duce the  NASA  Administrator,  I  want  to  go  over  a  few 
guidelines  for  this  morning's  press  conference.  We'll  begin 
with  questions  here  in  Washington,  and  then  go  to  the  var- 
ious NASA  centers.  Please  wait  for  the  microphone  before 
asking  your  question,  and  don't  forget  to  tell  us  your  name 
and  affiliation.  Because  of  the  large  number  of  reporters 
who  want  to  participate  in  today's  briefing,  please  limit 
your  inquiries  to  one  question  and  one  follow-up,  and, 
please,  please,  no  multi-part  quesUons.  Again,  thank  you 
for  taking  the  time  to  join  us  today,  and  allow  me  to  intro- 
duce the  NASA  Administrator,  Sean  O'Keefe. 

MR.  O'KEEFE:  Thank  you.  Glenn,  and  good  morning. 
Thank  you  all  for  spending  time  with  us  here  this  morning. 
Yesterday,  we  received  the  report  of  the  Columbia  Accident 
Investigation  Board  run  by  Admiral  Hal  Gehman,  and 
shortly  thereafter  I  had  the  opportunity  to  speak  to  several 
of  our  colleagues  here  throughout  this  agency  to  describe 
those  initial  findings  and  recommendations  as  well  as  to 
offer  some  views  of  what  the  direction  will  be  from  this 
point  forward.  And  so  if  you'll  permit  me.  let  me  draw  a  lit- 
tle bit  from  some  of  those  comments  here  in  the  context  of 
today's  discussion  with  you,  as  well,  as  we  start  this  and,  of 
course,  respond  to  your  questions. 

This  is,  I  think,  a  very  seminal  moment  in  our  agency's  his- 
tory. Over  the  45  years  of  this  extraordinary  agency,  it  has 
been  marked  and  defined  in  many  respects  by  its  extraordi- 
nary successes  and  the  tragic  failures  in  both  contexts.  And 
in  each  of  those,  in  a  tracing  of  the  history  of  that  45  years, 
there  is  always  an  extended  debate  and  discussion  of  the 
national  policy  as  well  as  the  focus  of  the  charter  and 
objective  of  exploration  of  what  this  agency  was  chartered 
and  founded  to  do  in  1958.  And  I  expect  that  in  this  circum- 
stance it  will  be  no  different.  This  is  one  of  those  moments 
in  which  there  will  certainly  be  a  very  profound  debate,  dis- 
cussion, and  I  think  a  very  inward  look  here  within  the 
agency  of  how  we  approach  this  important  charter  that 
we've  been  asked  to  follow  on  behalf  of  the  American  peo- 
ple to  explore  and  discover  on  their  behalf.  In  each  of  these 
defining  moments  as  well,  our  strength  and  resolve  as  pro- 
fessionals has  been  tested,  and  certainly  that  will  be  the 
case  in  this  circumstance,  and  it  has  been  for  these  past 
seven  months,  to  be  sure.  On  February  1st.  on  the  mornins 


of  that  horrific  tragedy  that  befell  the  NASA  families  and 
the  families  of  the  crew  of  Columbia,  we  pledged  to  the 
Columbia  families  that  we  would  find  the  problem,  fix  it. 
and  return  to  the  exploration  objectives  that  their  loved 
ones  had  dedicated  their  lives  to.  The  Board's  effort  and  the 
report  we  received  yesterday  completes  the  first  of  those 
commitments  and  does  it  in  an  exemplary  manner.  They 
have  succeeded  in  a  very,  very  thorough  coverage  of  all  the 
factors  which  caused  this  accident  and  that  led  to  this  sem- 
inal moment,  which  is  marked  by  a  tragic  failure.  And  their 
exceptional  public  service  and  their  incredible  diligence  in 
working  through  this  very  difficult  task  I  think  will  stand  us 
in  good  stead  for  a  long  time  to  come  as  we  evaluate  those 
tlndings  and  recommendations  as  carefully  as  we  know 
how. 

As  we  begin  to  fulfill  the  second  commitment  that  we  made 
to  the  families  to  fix  the  problems,  the  very  first  important 
step  in  that  direction  is  to  accept  those  findings  and  to  com- 
ply with  the  recommendations,  and  that  is  our  commit- 
ment. We  intend  to  do  that  without  reservation.  This  report 
is  a  very,  very  valuable  blueprint.  It's  a  road  map  to  achiev- 
ing that  second  objective,  to  fix  the  problem.  They've  given 
us  a  head  start  in  the  course  of  their  discussions  over  the 
last  several  months  and  in  the  course  of  their  investigation, 
in  the  public  testimony,  in  their  press  conferences,  in  all  of 
their  commentary,  which  has  been  very,  very  open  in  an 
extremely  inclusive  process  as  they  have  wrestled  with  the 
challenges  of  finding  the  problems  that  caused  this  partic- 
ular horrible  accident.  And  that  candor,  that  openness,  that 
release  of  their  findings  and  recommendations  during  the 
course  of  the  investigation  has  given  us  a  very  strong  head 
start  in  the  direction  of  fulfilling  that  second  commitment. 
At  this  point,  we  have  already  developed  a  preliminary 
implementation  plan,  and  we  will  update  that,  and  we're 
about  that  process  right  now  of  updating  to  include  all  the 
findings  and  recommendations  included  in  the  report,  in 
addition  to  those  that  were  released  and  described  very 
specifically  during  the  course  of  their  investigative  proce- 
dures. But.  again,  much  as  the  Chairman,  Admiral  Hal 
Gehman,  observed  throughout  the  course  of  those  proceed- 
ings, what  we  will  read  and  what  we  did  read  as  of  yester- 
day was  precisely  the  same  commentary  that  we  had  heard 
during  the  course  of  their  investigative  activities  and  in  all 
of  their  public  testimony  that  they've  offered,  which  has 
been  considerable  and,  again,  very  extensive,  exhaustive. 
So  as  we  implement  those  particular  findings  and  recom- 
mendafions,  our  challenge  at  this  point  will  be  to  choose 
wisely  as  we  select  the  options  that  are  necessary  to  fully 
comply  with  each  of  those  recommendafions.  We'll  contin- 
ually improve  and  upgrade  that  implementation  plan  in 
order  to  incorporate  every  aspect  of  knowing  what's  in  the 
report,  but  also  so  much  of  what  we  ha\  e  determined  and 
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seen  as  factors  that  need  improvement  and  consistent 
upgrading  throughout  our  own  process  within  the  NASA 
family.  It's  going  to  be  a  long  road  in  order  to  do  that,  but 
it  is  necessary  in  order  to  fulfill  that  second  commitment 
we've  made  to  the  families. 

Now,  the  report  covers  hardware  failures,  to  be  sure,  but  it 
also  covers  human  failures  and  how  our  culture  needs  to 
change  to  mitigate  succumbing  to  these  failings  again.  We 
get  it.  Clearly  got  the  point.  There  is  just  no  question  that  is 
one  of  their  primary  observations,  that  what  we  need  to  do, 
we  need  to  be  focused  on,  is  to  examine  those  cultural  pro- 
cedures, those  systems,  the  way  we  do  business,  the  princi- 
ples and  the  values  that  we  adhere  to  as  a  means  to  improve 
and  constantly  upgrade  to  focus  on  safety  objectives  as 
well  as  the  larger  task  before  us  of  exploring  and  discover- 
ing on  behalf  of  the  American  people.  But  they've  been 
very  clear  in  their  statements  throughout  the  report  in  sev- 
eral instances,  repetitively,  and  in  the  public  commentary 
that  the  Chairman  and  members  of  the  Board  have  offered 
following  their  efforts  yesterday  after  the  release  of  the 
report,  that  these  must  be  institutional  changes.  And  that's 
what  we're  committed  to  doing,  and  that  will  assure  that 
over  time  those  changes  will  be  sustained,  as  those  process, 
procedures,  and  systems  are  altered  in  order  to  reinvigorate 
the  very  strong  ethos  and  culture  of  safety  and  exploration, 
those  dual  objectives  that  we  have  always  pursued.  That  is 
what's  going  to  withstand  the  test  of  time  if  we  are  success- 
ful in  this  effort,  and  we  fully  intend  to  be.  So  we  will  go 
forward  now  and  with  great  resolve  to  follow  this  blueprint 
and  do  our  best  to  make  this  a  much  stronger  organization. 
In  the  process  of  doing  so,  it  will  involve  the  capacity  and 
capability  of  all  of  us  within  this  agency. 

This  is  not  about  an  individual  program.  It's  not  about  an 
individual  aspect  or  enterprise  of  what  we  pursue.  It  is 
about  everything  we  do  throughout  this  agency.  There  is  so 
much  of  what  has  been  observed  in  this  report  that  really 
has  tremendous  bearing  and  tremendous  purpose  in  defin- 
ing everything  we  do  throughout  the  agency.  And  so,  there- 
fore, we  will  approach  it  and  have  considered  this  to  be  an 
agency-wide  issue  that  must  be  confronted  in  that  regard. 
Now,  this  is  a  very  different  NASA  today  than  it  was  on  the 
1st  of  February.  Our  lives  are  forever  changed  by  this  trag- 
ic event,  but  certainly  not  nearly  as  much  as  the  lives  of  the 
Columbia  families.  This  is  forever  for  them.  And  so  that 
resolve  to  find  the  problem  which  we  have  successfully 
done,  thanks  to  the  extraordinary  efforts  on  the  part  of  this 
Board,  to  fix  those  problems  which  we  are  now  in  pursuit 
of  as  the  second  commitment,  and  to  return  to  the  explo- 
ration objectives  that  their  loved  ones  dedicated  their  lives 
to  is  something  we  take  as  an  absolute  solemn  promise.  We 
have  to  resolve  and  be  as  resolute  and  courageous  in  our 
efforts  as  they  have  been  in  working  through  this  horrible 
tragedy.  The  time  that  we  have  spent,  I  think,  over  the 
course  of  since  the  accident,  and  certainly  well  before,  in 
trying  to  work  through  those  particular  questions,  again, 
are  focused  on  institutional  change.  Since  I  arrived  a  little 
less  than  a  year  and  a  half  ago,  we  have  almost  completely 
rebuilt  the  management  team,  and  so  it  is  a  new,  fresh  per- 
spective in  looking  at  a  range  of  challenges  that  we  current- 
ly confront,  and  those  changes  have  been  ongoing  of  a 


management  team  as  well  as  the  institutional  changes  we 
have  implemented  and  will  continue  to  do  in  full  compli- 
ance with  this  report. 

The  new  management  team  began  I  think  by  evaluating  ini- 
tially on  the  first  day  that  I  airived  here  the  contingency 
planning  effort  that  was  necessary  in  the  event  of  such  a 
tragedy.  It  was  the  first  thing  I  did  on  the  first  morning  I 
arrived  at  this  agency.  And  in  reviewing  that  contingency 
plan  of  how  we  would  respond  to  a  disaster,  to  a  tragic 
event,  which  I  had  hoped  and  was  in  the  expectation  and 
fond  hope  that  I  would  never,  ever  have  to  utilize,  we 
nonetheless  improved  that  contingency  planning  effort  by 
doing  two  things:  First  of  all,  reaching  back  to  the  Rogers 
Commission,  the  Challenger  incident  and  accident,  to 
incorporate  in  that  contingency  plan  all  the  changes  neces- 
sary in  order  to  respond  definitively.  The  second  step  we 
went  through  was  to  specifically  benchmark  it  against  best 
practices  of  any  comparable  organization,  of  which  there 
are  very,  very  few.  And  the  only  one  that  in  my  personal 
experience  that  I  was  aware  or  felt  had  any  direct  compara- 
bility to  the  risks  and  the  stakes  involved  was  the  Navy 
nuclear  program.  And  so  from  that  first  day,  we  upgraded 
that  particular  contingency  plan  based  on  the  benchmark- 
ing procedures  that  we  followed  through  with  them.  We 
then  began  a  very  vigorous  effort  by  late  spring,  early  sum- 
mer of  last  year  to  begin  a  comprehensive  benchmarking 
procedure  against  the  submarine  service  as  well  as  the 
naval  reactors  community,  to,  again,  pick  up  best  practices 
as  well  as  to  institutionally  change  the  way  we  do  business. 
And  that  process  is  ongoing  as  it  had  been  a  year  ago  as  we 
continue  to  make  those  changes.  That  was  a  lesson  I 
learned  very  specifically  in  my  tenure  as  Navy  Secretary 
better  than  ten  years  ago,  was  to  look  at  those  particular 
procedures  and  assure  that  we  have  incorporated  as  much 
of  that,  and  that  was  a  work  in  progress  that  will  continue. 
But,  again,  the  observation  by  Admiral  Gehman  and  the 
members  of  the  Board  yesterday  and  replete  throughout  the 
report,  it  is  not  about  changing  boxes  or  individual  faces  in 
each  of  those  positions.  It  is  about  the  longer-term  institu- 
tional changes  that  must  be  made.  And,  again,  to  that  point 
we  get  it.  It  is  about  the  culture  of  this  agency,  and  we  all 
throughout  the  agency  view  that  as  something  that's  appli- 
cable to  the  entire  agency,  not  any  individual  element  there- 
of. With  that,  I  thank  you  again  for  the  opportunity  to  get 
together  this  morning  and,  again,  look  forward  to  your 
questions  and  comments. 

MR.  MAHONE:  Yes,  sir? 

QUESTION:  Mr.  Administrator,  Matt  Wald,  New  York 
Times.  There  are  other  organizations  that  have  gone 
through  this  kind  of  change.  Most  have  called  for  some  out- 
side help.  I'm  tempted  to  ask  if  you're  read  Diane  Vaughn's 
book  or  called  her  up  or  if  there  are  other  specialists  in 
safety  culture  who  you  would  be  bringing  in  at  this  time  to 
help  transform  yourself,  your  agency. 

MR.  O'KEEFE:  1  appreciate  that.  Yes,  indeed,  we  have 
read  Dr.  Vaughn's  book,  and  there  have  been  several  folks 
here  in  headquarters  as  well  as  Johnson  who  have  been  in 
touch  with  her.  Dr.  Michael  Greenfield  spoke  to  her  I  think 
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initially  about  four  months  ago,  three  months  ago.  shortly 
after  her  testimony  before  the  Columbia  Accident 
Investigation  Board's  hearings.  The  primary  source  of  safe- 
ty experts  that  we  have  been  trying  to  encourage  and  have 
requested  come  in  to  assist  with  us,  again,  are  from  the 
naval  reactors  community.  This  is  a  very  specific  set  of  pro- 
cedures they  follow.  It's  a  very  exhaustive  effort  that  they 
have  gone  through  over  a  comparable  period  of  time  as  the 
span  of  this  agency,  in  order  to  upgrade  their  procedures  as 
a  consequence  of  incidents  in  the  early  phases  of  that  pro- 
gram that  gave  them  great  pause.  And  so  there's  a  report 
that  I  think  was  released  about  a  month  and  a  half  ago 
which  was  the  second  step  in  that  benchmarking  procedure 
with  the  submarine  service,  which  is  the  operational  com- 
munity, and  the  naval  reactors  community,  which  is  the  dis- 
ciplinaires,  if  you  will,  over  the  technical  requirements 
side,  that  we  continue  to  solicit.  Beyond  that,  there  are  cer- 
tainly a  number  of  folks  that  we  have  invited  in  and  will 
continue  to  do  so.  I  spent  the  better  part  of  four  hours  last 
night  with  Admiral  Gehman  and  most  of  the  members  of 
the  Board  asking  them  specifically  for  the  folks  that  they 
had  brought  in  as  advisers  to  the  Board  on  this  particular 
question  so  we  may  be  in  contact  with  them  in  order  to  ask 
for  their  advice  and  assistance  and  contributions  in  this 
regard  as  we  implement  these  recommendations  on  that 
front  as  well.  So.  yes,  we're  about  that  as  well. 

MR.  MAHONE:  Keith? 

QUESTION:  Keith  Cowing.  Nasawatch.com.  Yesterday 
you  read  Gene  Kranz's  inspiring  words  that  were  issued  to 
his  troops  after  another  accident.  And,  you  know,  that  was 
then  and  this  is  now.  You've  got  a  workforce  that  has  been 
downsized,  bought  out,  they're  jaded  by  innumerable  man- 
agement fads,  and  clearly  it  hasn't  worked.  I  got  an  e-mail 
from  somebody  yesterday  saying,  "What's  he  going  to  do, 
actually  make  us — write  us  on  the  white  board?"  I  mean, 
the  cynicism  is  that  high.  What  are  you  going  to  do  this 
time  that  is  demonstrably  different  than  all  these  attempts 
before  it,  getting  the  agency  motivated  and  beyond  the  cyn- 
icism and  malaise  that  seems  to  have  beset  it? 

MR.  O'KEEFE:  Well,  it's  going  to  require  leadership  at 
every  level.  This  is  not  something  that  you  direct  or  dictate. 
Again,  in  my  experience,  in  my  prior  life  as  the  Navy 
Secretary  confronted  with  an  incident,  an  event  that  really 
rocked  that  institution  at  that  time,  when  I  came  in,  in  the 
post-Tailhook  incident,  it's  not  about  just  walking  around 
telling  everybody  shape  up  or  ship  out.  It  really  takes  per- 
sistent, regular,  constant  leadership  focus,  and  I  think  the 
folks  that  we  have  recruited  and  are  in  place  now  as  the 
senior  management  team  that,  again,  have  been  over  the 
course  of  certainly  this  last  seven  months,  to  be  sure,  but 
over  the  previous  year,  have  been  recruited  to  those  capac- 
ities specifically  for  that,  are  the  kinds  of  people.  I  think, 
who  not  only  get  it  but  also  are  going  to  be  the  first  start  at 
that  leadership  objective.  Throughout  the  agency  we're 
going  to  have  to  persistently  move  through  that,  but  I  think 
it  is  staying  with  a  very  set  of  clear  principles  and  values 
that  we  will  continue  to  work  through,  and  it's  going  to  take 
time,  but  the  time  begins  right  now.  And  it  has  been  in 
process,  I  think,  for  some  period  before  this,  but  we  will 


continue  to  redouble  our  efforts  of  that.  But  it's  something 
that  there  is  no  one  trick  pony  at  this.  It  is  not  something 
that  happens  simply  because  I  send  out  a  memo.  I'm  not  a 
Pollyanna  on  that  point  at  all.  It  is  something  that  really 
requires.  I  think,  constant,  unrelenting  diligence,  and  that  is 
another  theme  that  I  think  comes  out  very  resolutely  in  the 
Accident  Investigation  Board  report,  which  is  consistency 
as  well  as  persistence  and  vigilance  in  the  leadership  direc- 
tion in  that  regard.  And  that's  what  we  are  committed  to 
doing. 

MR.  MAHONE:  Yes,  sir? 

QUESTION:  Thank  you.  I'm  Larry  Wheeler  with  Gannett 
News  Service.  I  want  to  get  back  to  the  leadership  question 
a  little  bit.  I  was  wondering  if  you  could  share  with  us  your 
thinking  about  how  you  motivate  your  leaders  to  follow 
through  on  this  point  that  you  said  they  get  it.  Two  weeks 
ago,  one  of  your  senior  managers  had  a  press  conference  at 
Kennedy  Space  Center  in  which  he,  if  I  understand — if  I 
recollect  correctly,  he  denied  that  there  was  a  culture  in 
NASA  or  that  he  was  aware  that  there  was  a  culture  in 
NASA.  And  this  is  the  same  senior  manager  who  ran  the 
Safety  and  Mission  Assurance  Program  throughout  the 
'90s,  which  has  been  highly  criticized  by  the  CAIB.  Can 
you  give  us  your  thinking?  How  do  you  turn  around  that 
kind  of  thinking? 

MR.  O'KEEFE:  Well,  first  of  all,  I  think  it's  a— it's  always 
a  challenge  to  define  with  common  specificity  to  which  all 
accept  of  what  the  term  "culture"  means.  And  in  my  expe- 
rience, again,  as  Navy  Secretary,  there  were  multiple  cul- 
tures. There's  the  culture — there's  a  Navy  culture,  to  be 
sure,  and  a  naval  service  ethos.  But  there's  also  a  surface 
sailor  culture,  an  aviator's  culture,  a  submariner's  culture. 
And  then,  just  to  really  get  some  extraordinary  oomph  into 
it,  let's  get  the  Marine  Corps  involved.  They're  part  of  the 
Navy  Department  as  well.  And  the  common  distinctions 
between  those  are  born  of  years  of  history  as  well  as  deep 
tradition.  It  is  also  true  here.  There  is  every  single  aspect  of 
how  this  agency  has  formed  over  its  45  years  and  well 
before  when  at  the  beginning  of  the  last  century  the  NACA 
was  formed  to  respond  to  aeronautics  challenges  at  that 
time  that  were  to  be  advanced.  Every  one  of  the  centers, 
every  one  of  the  elements  of  what  you  see  throughout  this 
agency,  can  reach  back  and  trace  historical  roots  to  each  of 
those  individual  moments.  And  so  in  that  regard,  there  are 
lots  of  different  ways  in  which  folks  respond,  but  the  over- 
all, overarching,  overriding  NASA  culture  for  this  agency 
overall  is  a  set  of  principles  and  discipline  in  order  to  pur- 
sue safety  of  program  consideration,  which  has  always 
been  the  case,  in  pursuit  of  those  exploration  objectives. 
Those  are  the  kinds  of  things  we  need  to  redouble,  and, 
again,  as  you  define  it  very  specifically  in  that  regard,  there 
is  importance  that  I  think  we  get  great  clarity  of  exactly 
what  the  definition  is,  and  that's  the  part  we  get.  There  is  an 
overriding  culture  which  must  dominate,  and  certainly  we 
celebrate  the  history  and  traditions  of  every  aspect  of  this 
agency,  much  as  any  other  storied  agenc\  '-i  pstiUition 
does. 

MR.  MAHONE:  Yes,  sir? 


COLUMBIA 

SUPPLEMENTAL    MATERIAL 


QUESTION:  Earl  Lane  with  Newsday.  A  lot  of  what  the 
report  spoke  about  on  culture,  though.  I  think  dealt  with 
attitudes  as  much  as  institutions  and  talked  about  how 
lower-level  engineers  were  reluctant  to  come  forward  with 
the  concerns.  And  I'm  wondering  how  you  deal  with  that  to 
get  that  message  out,  and  is  it  perhaps  time  for  a  stand- 
down  like  the  Navy  sometimes  does? 

MR.  O'KEEFE:  Well,  it  is — to  be  sure,  that's  one  of  their 
findings  and  views,  is  that  there  is — there  was  evidence  that 
they  saw,  even  in  the  course  of  their  investigation,  in  which 
reluctance  dominated.  And  I  think  part  of  that  is — or  the 
two  things  we've  really  got  to  focus  on  in  that  direction  is, 
first  of  all,  reinforce  that  principle,  which,  again,  we  artic- 
ulate regularly  and  I  think  we  see  evidence  of  all  the  time. 
There  was  a  stand-down  in  June  through  October  of  last 
year  in  which  an  individual  observed  an  anomaly  on  the 
fuel  line  for  Atlanfis.  There  was  a  crack  on  the  fuel  line  that 
in  turn  stood  down  the  fleet  for  that  period  of  four  months 
as  we  ran  that  to  parade  rest  and  determined  exactly  what 
the  conclusions  and  solutions  needed  to  be.  So  we've  got 
to,  again,  continually  identify  that  as  the  kind  of  behavior 
we  want  to  encourage,  and  to  the  extent  we  do  not  see  it 
evidenced  or  there  is  evidence  in  the  opposite  direction,  to 
assure  that  we  motivate  and  encourage  folks  to  feel  that 
sense  of  responsibility.  And  that's  the  second  part  as  well, 
is  that  there  is,  I  guess,  a  renewal  of  the  view  that  I  heard 
expressed  best  by  Leroy  Cain,  the  Flight  Director  on  STS- 
107,  who  observed  this  is  all  of  our  responsibility.  And  so 
for  those  who  are  part  of  this  agency,  we  have  to  renew  that 
view,  and  for  those  we  recruit  to  that  have  to  have  it  under- 
stand as  the  first  principle  that  we  all  must  adhere  to. 

MR.  MAHONE:  Yes,  Tracy? 

QUESTION:  Tracy  Watson  with  USA  Today. 
Administrator,  did  you  have  any  hints  before  the  accident 
that  you  had  this  kind  of  serious  attitude  and  value  problem 
at  the  agency? 

MR.  O'KEEFE:  Well,  to  be  sure,  there's  always  cases  in 
which  there  are  folks  who  feel  like  there  are  certain  aspects 
of  what  has  occurred  in  the  course  of  our  history  or  in  the 
course  of  events  that  are  not  as  advantageous  as  others.  And 
so  I've  had  a  very  open  policy  of  let's  communicate  what- 
ever those  concerns  are,  let's  have  an  open  dialogue 
throughout  the  agency  on  every  matter.  I've  tried  to  be  as 
open  about  that  to  include  encouraging  e-mails,  of  which  I 
get  lots  of  from  lots  of  folks.  So  I've  seen,  I  think,  lots  of 
evidence  of  folks  who  are  feeling,  you  know,  very  empow- 
ered to  offer  their  view  and  their  concerns.  And  at  the  same 
time,  I  think  it's  also  evidence  of  the  fact  that  the  process 
or  the  systems  to  permit  that  discussion  isn't  happening  at 
every  level.  So  there's  two  things  you  can  draw  from  that 
that  I  have  taken  away,  which  is  those  who  feel  that  it's  nec- 
essary to  respond  in  that  regard  really  require  other  means 
because  the  systems  may  have  broken  down.  So  there  is 
certainly  some  indicator  of  that,  but  certainly  this  was  a 
wake-up  call  in  yesterday's  report  to  see  how  extensive  that 
communications  link  that  contributed  during  the  course  of 
this  mission  and  operation  needed  to  be  improved  to  deal 


with  precisely  that  set  of  problems.  It  wasn't  for  lack  of 
people  talking.  It  was  for  lack  of  people,  I  think,  coordinat- 
ing those  observations  effectively  to  serve  up  appropriate 
decision  making  about  the  challenges  we  were  confronting 
at  that  time.  And  I  think  that's — you  know,  the  upside  of 
that  is  that  there's  ample  evidence  to  suggest  that  folks  are 
feeling  like  there  is  an  opportunity  to  communicate  and 
speak.  It  is  also  another  quesdon,  though,  of  exactly  at  what 
level  can  they  do  so,  and  I  think  that's  the  point  and  the 
communications  breakdown  that  is  part  of  the  culture  and 
is  part  of  the  observation  that  was  made  by  the  Board,  and 
the  findings  and  recommendations  speak  to  that  very  effec- 
fively. 

MR.  MAHONE:  Yes.  ma'am? 

QUESTION:  Marsha  Dutton,  Associated  Press.  The  Board 
made — put  quite  a  bit  of  emphasis  on  deadline  pressure 
affecting  decision  making  and  even  usurping  safety,  and 
that  this  pressure  came  from  on  high.  And  you're  up  there 
in  the  highness  here,  and  I'm  just  wondering-[Laughter.] 

QUESTION:  — do  you  feel  some  accountability  also  for 
this  accident  since  you've  frequently  made  mention  of  the 
February  2004  date? 

MR.  O'KEEFE:  Absolutely.  I  feel  accountable  for  every- 
thing that  goes  on  in  this  agency.  That's  a  part  of  the 
responsibility  and  accountability  I  think  you  must  accept  in 
these  capacities.  No  question  about  it.  The  Board,  I  think, 
was  very  specific  in  observing  that  schedules  and  milestone 
objectives  and  so  forth  are  important  management  goals  in 
order  to  achieve  outcomes,  and  these  are — this  is  an  appro- 
priate and  necessary  way  to  go  about  doing  business.  But 
their  observation  was  that  in  this  instance,  this  may  have 
influenced  managers,  may  have  begun  to  influence  man- 
agers to  think  in  terms  of  different  approaches  in  order  to 
comply.  And  in  that  regard,  I  think  we  have-we've  got  to 
take  great  heart  in  the  point  that — and  stock  in  the  point 
that  in  order  to  pursue  such  appropriate  management  tech- 
niques and  approaches  in  order  to  establish  goals,  objec- 
tives, and  milestones,  you  must  also  assure  that  the  checks 
and  balances  are  in  place  to  guarantee  that  paramount, 
number  one  objective,  which  is  safety.  In  the  course  of  my 
tenure  here,  there  was  not  a  single  flight  of  a  Shuttle  that 
occurred  when  it  was  scheduled.  Not  one.  And  so  as  a  con- 
sequence of  that,  I  think  the  system  has  demonstrated  the 
capacity  to  not  only  establish  what  those  objectives  would 
be,  but  also  a  capacity  and  a  flexibility  to  adjust  to  those 
based  on  the  realities  and  the  pressures  that  may  exist  at  the 
time.  Now,  the  fact  that  that,  again,  observed  by  the  Board 
as  may  have  begun  to  influence  a  decision  on  the  part  of 
managers  was  a  very  important  observation  and  one  that  we 
need  to  assure  that,  as  we  make  these  institutional  changes, 
that  we  adhere  to  the  same  management  principles  of  set- 
ting goals  and  objectives,  but  at  the  same  time  assuring  that 
the  checks  and  balances  are  in  place  they  not  override. 

MR.  MAHONE:  Yes,  sir? 

QUESTION:  Steven  Young  with  spaceflightnow.com.  You 
said  a  few  months  ago  that  you  warned  NASA  employees 
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this  report  was  going  to  be  ugly.  I'm  wondering:  Was  it 
ugly?  And  what  etfect  do  you  think  it's  going  to  have  on 
agency  morale? 

MR.  O'KEEFE:  Well.  I  think  Admiral  Gehman's  observa- 
tion, when  asked  the  same  question  yesterday,  was  that,  no, 
it's  clinical  and  very  straightforward.  And  there  is  no  ques- 
tion about  that.  It  is  a  very  direct  review.  It  is — again,  the 
whole  contingency  planning  effort  that  we  went  through  on 
the  prospect  that  something  like  this  could  happen  ended 
up  working  exactly — better  than  we  could  have  ever  antic- 
ipated in  that  sense.  That  Board  was  activated  that  day. 
They  met  for  the  first  time  at  5:00  p.m.  on  that  afternoon. 
So  they  were  immediately  about  the  business  of  investigat- 
ing, and  in  concert  with  that,  there  was-there  was  nary  a 
hint  or  suggestion  that  there  was  ever  any  point  throughout 
the  course  of  this  seven  months  in  which  we  sought  to 
influence  the  outcome  of  that  result.  What  we  wanted  was 
an  unvarnished,  straightforward  assessment  from  them,  and 
we  got  that.  Now,  I  think  the  approach  that  we  have  talked 
about  among  our  colleagues  here  in  the  agency  is  that  it 
would  be  that  straightforward  approach,  that  that  would  be 
that  direct  commentary,  and  then  in  the  process  of  reading 
through  this,  that  we'd  be  deliberate  about  following — 
accepting  those  findings  and  complying  with  those  recom- 
mendations in  order  to  strengthen  this  organization  in  the 
future.  I  think  we've  got  a  very  competent,  very  profession- 
al, extremely  well  considered  work  that  didn't,  you  know, 
spare  anything  in  risking,  you  know,  the  sensibilities  or  the 
emotions  or  sentiments  of  anybody  in  this  agency.  And 
that's  exactly  the  way  we  expected  it  to  be.  That's  what  we 
wanted  it  to  be.  And  that's  what  we  asked  for  them  to  do. 
And  they  did  it. 

MR.  MAHONE:  we're  going  to  take  one  more  question 
here,  and  then  we're  going  to  go  to  our  centers,  and  then  we 
will  come  back  here  in  just  a  few  moments.  Kathy? 

QUESTION:  Kathy  Sawyer,  the  Washington  Post.  Mr. 
O'Keefe,  the  report  pointed  out  that  the  schedule  leading 
up  to  next  February  was  going  to  be  as  challenging  and 
fast-paced  as  the  one  that  immediately  preceded  the 
Challenger  launch  in  1986.  Were  you  aware  of  that?  Did 
anybody  come  to  you  and  say,  hey,  we're  pressing  too 
hard?  And  what  do  you  feel  about  that  now  in  light  of 
events? 

MR.  O'KEEFE:  Well,  again,  the  scheduling  and  the  mani- 
fest, as  it  were,  the  milestones  and  so  forth  that  were  set, 
was  established  by  the  Shuttle  Program  Office  and  the 
International  Space  Station  program  management  at  the 
request  to  specifically  idenUfy  the  optimum  systems  engi- 
neering approach  for  deployment  of  all  of  the  components 
of  the  International  Space  Station.  So  they  laid  out  the 
schedule.  They  established  what  those  dates  would  be  and 
milestone  objectives  would  be.  And,  again,  in  the  course  of 
my  tenure,  there  was  not  a  single  launch  that  occun'ed 
when  it  was  actually  scheduled.  So  I  think  the  approach 
that  we  adhered  to  at  the  time,  as  well  as  continue  to,  I 
think,  is  to  always  set  what  our  milestone  objectives  and 
goals,  and  clearly  the  establishment  of  the  core  configura- 
tion of  the  International  Space  Station  was  an  objective  that 


our  international  partners  looked  to.  Members  of  Congress, 
all  kinds  of  folks  examined  and  viewed  as  one  of  the  sem- 
inal aspects  that  needed  to  be  achieved  in  order  to  permit 
then  a  wider  debate  of  what  that  broader  composition  or 
configuration  of  the  International  Space  Station  could  be. 
But  you  had  to  reach  that  point  first.  And  so  in  dealing  with 
that,  the  approach  that  the  International  Space  Station  and 
the  Shuttle  Program  office  devised  was  that  schedule  for 
the  optimum  engineering  configuration  necessary  to  do  so, 
and  the  operational  considerations  were  factored  into  it. 
And,  again,  at  every  single  interval,  at  any  point  in  which 
there  appeared  to  be  any  anomaly,  the  flight  schedule  was 
adjusted,  as  it  was  for  every  single  flight  since  I've  been 
here.  There  has  not  been  one  that  flew  on  the  day  on  which 
the  launch  schedule  dictated  it  should.  And  that's,  again, 
appropriate,  necessary.  The  stand-down  that  occurred  from 
June  to  October  of  last  year  was  a  direct  consequence  of 
that.  So  all  those  factors,  I  think  the  paramount  objective 
that  we  continue  to  look  to  is  the  safety  objective.  And, 
again,  that's  what  the  Board  report  points  to,  is  that  the 
checks  and  balances  really  needed  to  be  reinforced,  and  we 
need  to  be  mindful  in  the  future  that  those  be  in  place  as  we 
use  that  appropriate  management  tool,  as  they  have  identi- 
fied it,  of  establishing  goals,  objectives,  and  milestones. 

MR.  MAHONE:  Sir,  we're  going  to  go  to  Stennis  first,  so, 
Stennis  Space  Flight  Center? 

QUESTION:  Hi,  Administrator.  This  is  Keith  Darcy  with 
the  Times-Picayune  out  of  New  Orleans.  Can  you  say  how 
the  return  to  flight  process  will  affect  the  long-term  flight 
schedule  of  the  Shuttle,  and  specifically  the  production 
level  at  the  external  fuel  tank  plant  in  New  Orleans. 

MR.  O'KEEFE:  I  wouldn't  speculate  at  this  moment. 
We've  really — we've  received  the  report  yesterday,  and 
what  we  have  put  together,  again,  is  an  implementation 
plan  in  its  preliminary  form  based  on  everything  that  the 
Board  identified  in  its  public  statements  and  commentary 
and  in  the  written  material  they  sent  to  us  as  preliminary 
findings  over  the  course  of  the  last  several  months.  Now  we 
have  the  benefit  of  the  entire  report.  We're  going  to  update 
and  upgrade  that  implementation  plan.  We  hope  to  release 
that  here  in  the  next  ten  days  to  two  weeks  so  we  can  iden- 
tify what  those  objectives  are,  informed  by  the  report.  We 
also  have  a  number  of  factors  and  issues  that  we  have  iden- 
tified within  the  agency  that  need  to  be  adjusted  prior  to 
return  to  flight.  And  so  as  that  unfolds  in  the  weeks  and 
months  ahead,  we'll  be  able  to  establish  exactly  what  it  will 
take  in  order  to  achieve  that.  But,  again,  the  paramount, 
overriding  factor  in  this  case  is  going  to  be  that  we  comply 
with  those  recommendations,  and  when  we  are  fit  to  fly, 
that's  when  that  milestone  will  be  achieved  on  return  to 
flight. 

MR.  MAHONE:  We'll  go  to  Langley.  Langley? 

QUESTION:  This  is  Dave  Schlect  with  the  Daily  Press.  I 
have  a  question  about  the  Safety  Center  being  developed 
here  at  Langley.  One  of  the  Board's  recomr-!end."i!ons  is  to 
establish  an  independent  technical  engine-  ,:  ;'i'.ihority 
that  would  be  the  sole  waiver-grantin;/     ■  -   for  all 


COLUMBIA 

SUPPLEMENTAL    MATERIAL 


technical  standards.  It  would  decide  what  is  and  what  is  not 
an  anomalous  event  and  would  independently  verify  launch 
readiness.  How  might  the  new  NASA  Engineering  and 
Safety  Center  fulfill  this  recommendation? 

MR.  O'KEEFE:  Well,  we're  sorting  through  that  right  now. 
The  initial  charter  of  the  Safety  Center  has  been  formulat- 
ed. As  a  matter  of  fact,  Brian  O'Connor  is  there  at  Langley 
today,  working  with  General  Roy  Bridges,  the  Center 
Director  at  Langley,  and  others  in  order  to  begin  working 
through  the  findings  and  recommendations  of  this  report 
and  how  it  will  affect  how  we  should  adjust  the  charter  of 
the  NASA  Engineering  and  Safety  Center.  The  approach 
that  is  identified — and,  again,  we  spent  a  lot  of  dme  last 
night  talking  to  Admiral  Gehman  and  his  colleagues  on  the 
board — of  exactly  how  we  may  consider  various  approach- 
es here,  and  they  were  more  in  the  listening  mode  of  what 
that  could  be,  because,  again,  they  have  not  been  disposi- 
tive about  which  options  we  should  select  other  than  to, 
again,  reiterate  that  the  recommendations  are  to,  again, 
establish  that  independent  technical  authority  for  the  con- 
trol of  requirements  of  the  Space  Shuttle  Program.  And 
that's  a  factor  of  whether  or  not  that's  part  of  the 
Engineering  and  Safety  Center,  which,  frankly,  could  serve 
as  more  of  a  research  and  development,  testing,  trend 
analysis  ki,nd  of  center  and  an  organization  that  can  come 
in  to  regularly  examine  what  our  processes  and  procedures 
are  with  a  fresh  set  of  eyes  all  the  time,  and  to  have  the 
influence  during  the  course  of  operational  activities  to 
identify  cases  where  they  see  anomalies  that  have  some  his- 
torical or  trend  assessment  to  it,  that's  the  issue  that  we've 
really  got  to  sort  through,  is  whether  or  not  you  have  both 
of  those  capacities  inherent  in  the  same  organization  or 
whether  it  should  be  two  separate  functions.  In  the  time 
ahead,  very  short  time  ahead,  that's,  you  know,  the  set  of 
options  we  really  need  to  sort  through  in  order  to  comply 
with  those  recommendations,  which  I  think  are  solid. 


The  science  component  will  be  drawn  from  an  effort  that 
we  conducted  through  last  summer  and  early  fall,  not  quite 
a  year  ago,  which  was  an  effort  to  prioritize  what  the  sci- 
ence performance  will  be  aboard  the  International  Space 
Station.  We  had  a  blue-ribbon  panel  of  external  scientists 
representing  every  single  scientific  discipline  who  came  in 
to  specifically  organize  what  that  priority  sequence  is.  Until 
that  time,  it  was  a  collection  of  priorities  from  every  disci- 
pline, all  of  which  ranked  number  one.  And  so  when  every- 
thing is  number  one,  that  means  nothing  is  number  one.  Sc 
what  the  Board — what  was  referred  to  the  re-map  effort  die 
last  summer  and  fall  that  organized  that  prioritization  set 
actually  had  a  rank  order  that  began  with  the  number  one 
and  moved  through  by  sequence,  two,  three,  four,  and  five, 
and  so  that  is  the  sequence  in  which  we  will  organize  the 
Space  Station  scientific  objectives  from  this  point  forward, 
because  that  is  the  primary  source  of  all  the  scientific 
micro-gravity  experimentation  that  will  be  carried  out  in 
the  future,  is  aboard  the  International  Space  Station.  So 
we'll  adhere  to  that  blueprint  very  carefully. 

MR.  MAHONE:  Sir,  we  have  a  question  at  the  Kennedy 
Space  Center. 

QUESTION:  Mr.  O'Keefe,  this  is  Jay  Barbee  with  NBC 
News.  In  talking  with  the  workers  here  and  in  Houston,  I'm 
finding  they  are  very  encouraged  with  you  at  the  helm. 
They  believe  at  this  time  in  NASA's  history  that  you  are  the 
right  man  for  the  job.  Now,  they're  encouraged  by  your 
honesty  and  your  willingness  to  admit  NASA's  mistakes. 
But  their  concern  is  still  communications.  It  has  been  sti- 
fled, and  many  with  safety  concerns  have  been  intimidated 
into  silence,  in  fear  of  losing  their  jobs.  Can  you  today  reas- 
sure any  NASA  or  contractor  employee  if  they  speak  up 
with  safety  concerns,  even  to  members  of  the  press,  that 
they  won't  be  fired,  that  they  won't  suffer  setbacks  in  theii 
careers? 


MR.  MAHONE:  Next  would  be  the  Glenn  Research 
Center. 

QUESTION:  Mr.  Administrator,  Paul  Winovsky  (ph)  from 
WOIO  Television.  I'm  working  on  an  assumption  here  that 
there's  a  backlog  of  science  waiting  to  fly  once  safety  con- 
cerns are  handled.  How  will  you  go  about  prioritizing  what 
flies  in  the  payloads.  For  example,  the  combustion  experi- 
ment developed  here  was  destroyed  on  the  last  mission.  Is 
the  pipeline  full?  And  how  will  you  prioritize  what  goes 
into  space  next? 

MR.  O'KEEFE:  That's  a  very  good  question.  There  are  two 
approaches  we're  going  to  use  to  this.  The  first  one  is  that 
if  you  go  to  the  Kennedy  Space  Center  today,  the  payload 
processing  facility  and  all  the  International  Space  Station 
program  elements  that  have  arrived  are  stacked  up  in 
sequence  and  are  being  tested  and  checked  out  for  deploy- 
ment at  the — as  soon  as  the  resumption  of  flight  occurs.  So 
there  will  be  not  a  lot  of  confusion  about  exactly  what  that 
sequence  will  be.  It's  going  to  follow  the  pattern  that, 
again,  fits  that  optimum  systems  integration,  engineering 
strategy  that  is  best  for  the  production — construction  of  the 
International  Space  Station  to  reach  the  core  configuration. 


MR.  O'KEEFE:  Absolutely.  We  get  it,  and  that's  what  mes- 
sage has  been  transmitted  and  understood  by  every  single 
leader  and  senior  official  in  this  agency,  is  that  we  need  ta 
promote  precisely  that  attitude.  So  the  answer  is  absolute- 
ly, unequivocally  yes. 

MR.  MAHONE:  Johnson  Space  Center? 

QUESTION:  Gina  Treadgold  with  ABC  News.  Sir,  you've 
said  you  take  responsibility.  Do  you  plan  to  step  down  as  a 
result  of  this?  Or  do  you  feel  any  pressure  to  resign? 

MR.  O'KEEFE:  Well,  certainly  I  serve  at  the  pleasure  of 
the  President  of  the  United  States,  and  I  will  adhere  to  his 
judgment  always  on  any  matter,  including  that  one.  And  so, 
no,  there  is  nothing  that  in  my  mind  transcends  that 
requirement,  and  I  intend  to  be  guided  by  his  judgment  in 
that  regard. 

MR.  MAHONE:  Marshall  Space  Flight  Center? 

QUESTION:  Shelby  Spires  with  the  Huntsville  Times. 
Given  that  the  Board  suggests  that  the  external  tank  be 
blown  with  no  foam  loss,  and  engineers  say  this  isn't  pos- 
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sible.  is  NASA  prepared  to  redesign  the  tank  without  foam 
and  go  to  Congress  to  ask  for  the  money  to  do  this? 

MR.  O'KEEFE:  We'll  see.  I  mean,  there  may  be  an  option 
down  the  road  in  which  will  be  selecting  to  do  something 
along  those  lines.  Don't  know.  But  the  approach  that  I  think 
very  clearly  articulated  yesterday  by  the  Accident 
Investigation  Board  membership  was  that  there — just 
based  on  the  current  configuration  and  the  safety  consider- 
ations, the  issue  of  foam  loss  per  se  is  not  something  they 
find  as  being  totally  disqualifying.  What  they  do  find  to  be 
a  problem  and  what  was  a  contributor,  to  be  sure,  a  causal 
effect  based  on  what  is  the  likely  condition  of  what 
occurred  in  that  first  81  seconds,  was  the  departure  of  the 
bipod  ramp  from  the — insulation  from  the  external  tank 
which  struck  the  leading  edge  of  the  orbiter.  That's  the  part 
that  already  we  have  eliminated  as  a  factor  that's  going  to 
be  heating  segments  around  that  area  to  act  as,  instead  of 
the  insulation,  so  you  will  not  fmd  an  insulated  bipod  ramp 
at  that  point  on  the  external  tank  in  the  future.  Exactly  how 
much  further  that's  going  to  need  to  go,  that's  one  of  the 
things  that  I  think  in  the  report  they  said  very  specifically 
we  ought  to  aggressively  develop  a  program  to  eliminate 
departure  of  any  debris  of  insulation  coming  off  the  exter- 
nal tank.  And  that's  the  part  that  has  already  been  tasked 
and  that  Bill  Readdy,  as  part  of  the  return  to  flight  eftbrt, 
has  already  charged  our  external  tank  management  team 
over  to  look  at.  So  we'll  be  looking  to  the  results  of  that 
view,  and  all  the  options  are  on  the  table.  We'll  see  what 
comes. 

MR.  MAHONE:  We'll  take  two  more  quesUons  from  the 
centers,  and  then  we'll  come  back  here  to  headquarters,  and 
we'll  go  to  Dryden. 

QUESTION:  Mr.  Administrator,  this  is  Jim  Steen  with  the 
L.A.  Daily  News.  I  was  wondering  if  the  folks  at  NASA  are 
looking  at  the  possibility  of  bringing  Shuttle  landings  back 
to  Edwards  Air  Force  Base  as  a  safety  precaution.  And  I 
also  wanted  to  know  what  role,  if  any,  that  Dryden 
Palmdale  facility  will  have  in  your  return  to  space  opera- 
tions. 

MR.  O'KEEFE:  Well,  in  terms  of  the  option  of  landing  at 
Edwards,  to  be  sure,  that  is  an  option  we've  always  exerted 
and  used  anytime  the  weather  conditions  don't  permit  a 
return  to  the  Kennedy  Space  Center  in  Florida.  So  we'll 
continue  to  do  that,  and  anytime  there  is  a  condition  which 
would  dictate  that  we  land  on  the  west  coast,  that's  exactly 
what  we'll  do.  The  challenge  thereafter,  once  landing  at 
Edwards,  is  to  transport  the  orbiters  across  country,  and 
that's  something  that,  again,  one  of  the  quality  assurance 
and  risk  management  challenges  of  dealing  with  the  Shuttle 
orbiters.  is  the  more  you  touch  it  and  the  more  you  fiddle 
with  it,  the  more  likely  is  the  prospect  that  you  can  damage 
it.  And  every  time  we  do  that,  it  gets  more  and  more  diffi- 
cult to  sort  with,  because,  again,  it's  always  launched  from 
Cape  Canaveral  at  the  Kennedy  Space  Center.  So,  yes, 
Edwards  will  always  be  an  option,  and  it's  one  that  we  are 
not  deterred  by  that  challenge  if  there  are  factors  that  dic- 
tate the  consideration  of  landing  there.  In  terms  of  the 
Dryden  Center,  there  is  no  question  that  the  flight  opera- 


tions activities  that  are  continuing  to  go  on  there  that  cover 
a  wide  range  of  different  supporting  efforts  that  we  go 
through  for  unmanned  aerial  vehicles  for  the  Defense 
Department,  for  a  wide  range  of  different  programs,  no 
question  we  will  continue  to  see  that  activity  unabated 
there.  And  as  circumstances  dictate,  there  may  be  further 
flight  test  requirements  that  we  would  conduct  there  in  sup- 
port of  return  to  flight  activities  for  the  Shuttle. 

MR.  MAHONE:  We're  having  some  technical  difficulties 
at  JPL.  so  we'll  come  back  to  headquarters.  And,  Mr. 
Administrator,  if  I  could  start  off  with  Bill  Harwood,  we'll 
start  with  Bill. 

QUESTION:  Thanks,  Glenn.  Bill  Harwood,  CBS  News. 
Well,  just  looking  ahead  to  1 14,  I  think  the  previous  ques- 
tioner was  probably  asking  you  about  overflight  to  land  at 
Edwards  versus  Kennedy,  just  for  the  record.  My 

QUESTION:  Looking  at  1 14,  are  you  committed  to  not  fly- 
ing that  flight  until  you  have  both  a  tile  repair  capability 
and  an  on-orbit  RCC  repair  capability,  realizing  that  it's  the 
RCC  that's  obviously  the  long  pole  in  the  tent  right  now. 

MR.  O'KEEFE:  Well,  there's  no  question.  The  report  very 
specifically  divides  the  findings  and  recommendations  into 
those  areas  which  must  be  complied  with  prior  to  return  to 
flight.  We  intend  to  take  that  with  absolute  conviction,  no 
doubt  about  it,  and  we're  committed  to  doing  that.  Among 
them  is  the  point  of  an  on-orbit  repair  capacity,  and  that's 
the  range  of  options,  because  it  could  cover  a  wide  set  of 
circumstances.  We've  got  to  look  at  what  is  a  responsible 
set  of  options  in  order  to  provide  that  repair  capacity,  and 
those  are  the  things  we're  looking  at  right  now  as  weighing 
all  those  options  to  figure  out  what's  the  most  appropriate 
course  on  that.  But  it's  one  of  the  requirements  within 
the — or  what  we  view  as  a  requirement  within  the  report  as 
a  recommendation  that  must  be  complied  with  prior  to 
return  to  flight,  and  we  intend  to  adhere  to  that. 

MR.  MAHONE:  Mike? 

QUESTION:  Mike  Cabbage  with  the  Orlando  Sentinel. 
One  of  the  things  the  Board  made  pretty  clear  in  their 
report  was  that  they  have  a  concern  that  after  you  imple- 
ment cultural  changes,  that  NASA  will  sort  of  backslide  the 
way  that  it  did  after  the  Rogers  Commission.  What  can  you 
do  to  make  sure  that  cultural  changes  you  put  in  place  now 
will  sfill  be  in  eft'ect  5,  10,  15  years  from  now? 

MR.  O'KEEFE:  That's  a  point  that  we  really  have  spent  a 
lot  of  fime.  Again,  last  night  the  Board  was  generous  with 
their  time  for  several  hours  in  sorting  through,  and  that 
dominated  the  discussion  in  many  ways,  and  they  were 
consistent  and  repetitive  in  their  responses  to  this,  which  is 
it  can't  be  personality  dependent.  It's  got  to  be  a  set  of  insd- 
tutional  changes  that  will  withstand  any  change  in  leader- 
ship and  management  and  so  forth,  and  it's  got  to  be  a  set 
of  principles  and  values  that  are  reiterated  regularly  that 
then  become  institutionalized.  So,  I  mean,  the  ^m  nre  of 
that  is  going  to  be,  I  think,  over  time  if  we  se  ge 

in  the  mindset.  But,  importantly,  I'm  \  -  '  the 
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observations  that  several  have  made  in  the  pubhc,  which  is, 
yes,  we've  heard  this  before,  and,  yes,  they've  pledged  to 
do  these  things.  No  question,  that's  a  very  clear  criticism. 
All  I  can  offer  is  I  wasn't  here  at  that  time,  and  a  lot  of  folks 
who  were  in  senior  management  and  leadership  positions 
were  not  in  those  capacities  at  that  time  either.  So  we've  got 
to  move  forward  with  the  objective  of  adhering  to  what  the 
Board  has  said,  which  is  to  be  sure  that  it  not  turn  on  just 
the  individual  personalities  involved,  but  instead  become 
an  institutional  set  of  values  and  disciplines  that  will  with- 
stand that  test  of  time.  And  that's  going  to  be  the  real  meas- 
ure. It's  something  that,  again,  the  jury's  out.  We'll  see  how 
far  that  goes,  and  I'm  certain,  I'm  absolutely  certain  that 
you  will  be  the  judge  of  that. 

MR.  MAHONE:  Frank? 

QUESTION:  Frank  Sietzen  (ph)  with  Aerospace  America. 
Among  the  Board's  report — recommendations  yesterday 
was  that  the  Space  Shuttle  be  replaced  as  soon  as  possible. 
Admiral  Gehman  expressed  his  concern  that  there  wasn't  at 
least  a  design  candidate  on  the  drawing  boards,  he  said. 
Given  that,  are  you  looking  afresh  at  when  and  under  what 
circumstances  to  retire  the  Shuttle?  And  what  kind  of  mix 
of  systems  do  you  propose  to  do  so  with? 

MR.  O'KEEFE:  Well,  it's  exactly  one  of  the  charges  that  is 
now  slightly  over  24  hours  old  that  we  do,  so  maybe  I 
could — if  I  could  ask  you  for  another  hour  or  two  to  get 
through  that  analysis,  it  would  be  helpful.  But  we  are  try- 
ing, I  think,  to  sort  through  exactly  what  the  implications 
would  be  there  of  a  range  of  alternatives.  The  Board — what 
I  read  and  what  I  saw  in  the  report  was  very  specific  in  say- 
ing that  if  there  is  an  extension  of  the  Shuttle  operations 
beyond  the  beginning  of  the  next  decade,  it  must  be  recer- 
tified. And  so  establishing  what  those  recertification 
requirements  would  be  is  part  of  what  I  read  also  to  be  one 
of  theif  recommendations  and  findings,  that  we  establish 
exactly  how  we  would  go  about  doing  that,  so  that  you 
make  those  judgments  today  so  that  later,  when  those  deci- 
sions are  made  by  all  of  our  successors,  that  there  not  be 
just  matters  of  convenience  taken  at  the  time  to  determine 
what  the  recertification  requirements  would  be.  So  that's  an 
aspect  we've  got  to  think  about  now  in  anticipation  of 
tomorrow.  And,  finally,  the  approach  we  have  pursued  as  a 
consequence  of  the  President's  amendment  to  last  year's 
program  submitted  in  November  of  last  year  to,  as  part  of 
the  integrated  space  transportation  plan,  is  to  begin  an 
effort  for  a  crew  transfer  vehicle  that  is  focused  on  crew 
transfer  capacity  as  a  supplement  to  that  capability  that  we 
have  used  for  both  crew  transfer  as  well  as  heavy-lift  cargo 
assets  on  the  Shuttle.  And  so  we're  pursuing  that.  There  is 
a  very  aggressive  effort  right  now  to  be  very  specific  and 
very  deliberate  about  a  very  limited  number  of  require- 
ments, and  I  think  we  have  followed  through  on  what  the 
Board  observation  on  that  point  is,  which  is  to  make  sure 
that  those  requirements  are  very  straightforward  and  not  so 
extensive  that  it  requires  either  an  invention,  a  suspension 
of  the  laws  of  physics,  or  the  use  of  what  Admiral  Gehman 
referred  to  last  night  as  a  material  referred  to  as  "unobtani- 
um"  in  the  effort  of  trying  to  put  together  the  alternative.  So 
make  sure  it's  realistic,  is  something  that  is  technically 


doable  now,  and  that  is  the  set  of  very  limited  requirements 
that  we  have  put  together  for  a  crew  transfer  vehicle  that  is 
the  orbital  space  plane  configuration.  So  we'll  see  what  the 
results  from  the  creative  juices  and  innovation  of  the  indus- 
try will  be  here  in  the  weeks  and  very  short  months  to  fol- 
low. 

MR.  MAHONE:  Debra? 

QUESTION:  I'm  Debra  Zabarenko.  I  work  for  Reuters. 
You've  got  a  lot  of  big  challenges  contained  in  this  report, 
but  for  safety  concerns,  you  can  go  to  safety  experts  anc 
systems  analysts.  For  organizational  problems,  you  can  gc 
to  the  folks  who  are  expert  there.  But  one  thing  the  report 
said  that  NASA  needs  and  does  not  now  have  is  the  kind  of 
urgent  mission  that  it  had  during  the  Cold  War  years.  Are 
you  going  to  be  looking  to  the  White  House,  to  Congress's 
Where  are  you  going  to  go  for  guidance  on  dealing  with 
what  seems  to  be  one  of  the  biggest  underlying  problems 
that  the  report  remarked  on? 

MR.  O'KEEFE:  Absolutely.  Again,  as  I  mentioned  at  the 
very  opening  of  my  comments  here  this  morning,  in  each 
of  these  events  of  great  success  and  great  tragedy  it  has 
been  always  attendant  thereafter  with  a  very  extensive 
national  policy  debate.  And  sometimes  that  national  policy 
debate  has  resulted  in  a  set  of  objectives  that  are  identified, 
and  in  other  cases  it  has  been  unsatisfying.  Our  anticipation 
is  this  next  national  debate  coming  is  one  that  we  hope  and 
we  certainly  plan  for  it  to  be  a  satisfying  result.  And  how 
that  sorts  its  way  out  between  our  colleagues  within  the 
administration  as  well  as  in  Congress,  and  certainly  the 
general  public,  is  going  to  be  a  question  that  in  the  time 
ahead — and  Congress  has — the  committees  of  jurisdiction 
have  planned  a  set  of  very  aggressive,  very  extensive  pub- 
lic hearings  in  the  weeks  ahead  that  I  expect  will  spark  thai 
debate.  And  the  answer  to  your  question  I  think  will  be 
resolved  from  that  set  of  policy  debates  that  will  be  shortly 
coming. 

QUESTION:  Do  you  agree  with  the  report's  estimation  that 
that  is  something  that  NASA  doesn't  have  right  now,  an 
urgent  sense  of  mission? 

MR.  O'KEEFE:  Nothing  comparable  to  what  drove  us  as  a 
nation  with  the  threat  of  the  prospect  of  thermonuclear  war 
by  a  bipolar,  you  know,  opponent  on  the  other  side  of  this 
globe  that  existed  in  the  early  1960s.  No,  we  don't  have 
anything  nearly  as  earth-shattering  in  that.  Thank  God. 

MR.  MAHONE:  Frank? 

QUESTION:  Frank  Moring  with  Aviation  Week.  Another 
thing  that  the  space  program  needs  is  money,  and  there's 
been  some  bad  news  lately  from  the — most  recently  from 
the  Congressional  Budget  Office.  What  is  your  assessment 
of  the  budget  prospects  for  the  space  program  as  this 
national  debate  gets  underway?  And,  also,  what  do  you  see 
as  the  cost  of  meeting — in  rough  terms,  of  meeting  the! 
Gehman  recommendations? 

MR.  O'KEEFE:  Again.  I  would  not  even  speculate  on  what 
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the  national  debate  that  will  occur  over  the  federal  budget 
proposals  would  yield.  That's  going  to  be  in  the  time  ahead 
as  well.  That's  happening  currently.  I  think  you  pointed  that 
very  succinctly.  As  a  member  of  this  administration,  we 
certainly  are  going  to  be  valuing  and  evaluating  those  par- 
ticular consequences  in  the  context  of  what  is  necessary  to 
proceed  forward  with  compliance  with  these  recommenda- 
tions and  what  resource  requirements  we'll  have.  And  cer- 
tainly that  debate  will  continue  and  will  go  on  inside  the 
administration  as  well  as  within  the  Congress.  And  so  the 
results  of  that  will  be  known  in  due  time.  In  terms  of  what 
it's  going  to  cost  for  us  to  implement,  again,  if  you  give  me 
another  hour  on  top  of  the  one  that  I  asked  from  Frank  to 
figure  out  what  the  cost  is  beyond  just  evaluating  a  report 
24  hours  old,  we  might  be  able  to  get  back  to  you.  But  at 
this  juncture,  I  wouldn't  even  put  an  estimate  or  a  price  tag 
on  that  at  this  juncture. 

MR.  MAHONE:  Okay.  Brian? 

QUESTION:  Brian  Berger  with  Space  News.  One  of  the 
points  that  the  report  made  is  that  NASA  has  exhibited  a 
tendency  to  bite  off  more  than  it  can  chew,  have  more  ambi- 
tion than  budget.  Can  you  fix  Shuttle,  can  you  complete 
Station,  and  undertake  an  ambitious  effort  like  Project 
Prometheus  on  the  same  schedule  that  you've  laid  out  so 
far? 

MR.  O'KEEFE:  Well,  again,  this  is  not  a  new  observation, 
is  your  point.  It's  one  that  was  very  clearly  driven  home  to 
me  in  the  course  of  my  confirmation  hearings,  as  a  matter 
of  fact,  a  year  and  a  half  ago  by  several  Members  of 
Congress,  that  we  have  had  a  history  of  trying  to  do  too 
much  with  too  little  or  not  prioritizing  sufficiently.  And 
there  are  several  different  ways  to  go  about  looking  at  tech- 
nology management.  One  is  what  is  commonly  referred  to 
within.  I  think,  the  technology  sector  kind  of  approach, 
which  is  put  a  lot  out  there  and  let  a  thousand  flowers 
bloom.  And  the  ones  that  do  come  up  and  the  ones  that  are 
considered  to  be  of  greatest  value,  those  are  the  ones  you 
pursue.  Well,  maybe  that's  the  closest  comparable  manage- 
ment approach  of  technology  that  was  pursued  within  this 
agency  in  the  past.  Upon  my  arrival  here,  in  fairly  short 
order  we  established  that  there  were  three  mission  objec- 
tives: understanding  and  protecting  the  home  planet, 
exploring  the  universe  and  searching  for  life,  and  inspiring 
that  next  generation  of  explorers.  And  if  it  doesn't  fall  in 
those  three  mission  categories,  it  doesn't  belong  here — not 
because  it  isn't  a  neat  thing  to  do  or  would  be  interesting  or 
whatever  else.  So  in  the  course  of  the  past  year-plus,  we've 
been  really  going  through  the  process  of  winnowing  down 
what  are  the  programs  that  really  participate  and  contribute 
to  those  three  mission  objectives  very  succinctly,  and  those 
that  are  neat  ideas  and  good  things  to  do,  well,  we  try  to 
find  some  other  home  for  them  somewhere  else,  but  not 
here,  because  we're  trying  to  be  very  disciplined  and  very 
selective  about  what  we  do.  We've  got  to  continue  that 
effort  and  be  more  deliberate  about  it  in  the  future,  I  think, 
in  finding  those  efforts  that  fall  within  those  categories.  In 
terms  of  the  very  specific  example  that  you  cited  of  Project 
Prometheus  and  developing  power  generation  and  propul- 
sion capabilities,  that  is  something  that  comes  right  into  our 


wheelhouse  of  the  kinds  of  things  we  need  to  be  doing,  and 
it  marks  the  technology  kind  of  prowess  of  this  agency  that 
it's  been  known  for  four  decades,  which  is  to  overcome 
those  technical  obstacles  in  order  to  achieve  the  next  set  of 
exploration  objectives.  And  so  that  is  there  in  the  program. 
It's  fully  financed.  You  know,  the  money  that's  required  and 
the  resources  necessary  in  order  to  do  so  have  been 
approved  within  our  administration,  have  been  offered  to 
Congress  for  their  consideration.  And  we're  underway  with 
that  effort  because  that's  one  of  the  serious  long  poles  in  the 
tent  to  pursuing  future  exploration  objectives.  And  so  that 
one  tits  very,  very  precisely  within  those  three  mission  cat- 
egories, without  reservation  or  equivocation. 

MR.  MAHONE:  Mark? 

QUESTION:  Thank  you.  Mark  Carreau  (ph)  from  the 
Houston  Chronicle.  I  think  I  have  a  question  and  a  follow- 
up,  if  that's  okay.  What  do  you  contemplate — 

MR.  O'KEEFE:  How  can  you  have  a  follow-up  when  you 
haven't  heard  the  answer  yet?  [Laughter.] 

MR.  O'KEEFE:  Sorry.  Go  ahead. 

QUESTION:  Okay. 

MR.  O'KEEFE:  Pardon  me.  I  didn't  mean  to  be  flip. 

QUESTION:  That's  okay,  sir.  Thank  you.  What  do  you 
contemplate  doing  or  saying  to  your  managers  and  work- 
force to  explicitly  uncouple  schedule  pressure  to  build  the 
Space  Station  from  the  Shuttle  recovery? 

MR.  O'KEEFE:  Well,  let  me  take  the  first  part  of  that 
because  I'm  not  sure — Shuttle  recovery,  do  you  mean 
return  to  flight? 

QUESTION:  Yes,  sir. 

MR.  O'KEEFE:  Okay.  I'm  sorry.  Again,  the  point  that  I 
think  was  very  clearly  enunciated  in  the  report  that  resonat- 
ed with  me  is  that  this  may  have  begun  to  influence  the  pro- 
gram manager's  view  of  how  you  proceed  to  meet  mile- 
stone objectives.  Again,  that's  a  useful,  very  valuable  man- 
agement tool  that  has  to  establish  goals.  It's  a  leadership 
principle.  You  have  to  have  folks — again,  it's  part  of  the 
point  that  was  raised  in  several  other  questions  earlier,  too, 
that  you  have  to  have  goals,  you  have  to  have  objectives, 
you  have  to  enunciate  what  they  are  and  when  you  intend 
to  achieve  them.  That's  part  of  any  other  aspect  of  what  we 
do.  The  really  profound  point,  I  think,  that  the  Board  raised 
was  that  there  was  some  mixed  signal,  miscommunication 
of  that  point,  of  which  was  more  dominant.  And  so  the 
checks  and  balances  must  be  established,  and  they  were 
very  clear  on  that  point  repetitively  in  their — in  every  part 
of  the  report,  that  what  we  need  to  do  is  establish  institu- 
tionally an  ethos,  a  set  of  values,  a  discipline  that  really 
encourages  folks  to  have  an  open  communications  loop,  to 
express  when  they  believe  something  to  be  not  safe  at  that 
time  to  proceed  with.  Now,  that  may  not  rule  the  day.  It 
may  not  be,  well,  in  that  case,  since  you've  simply  asserted 
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it,  it  must  be  so.  There  really  is  a  case  in  which  we've  got 
to  demonstrate  that  it  is  safe,  and  that's  a  very  ditferent 
approach  that  now  the  burden  of  proof,  I  think,  has  to  be 
reiterated  in  that  direction  as  well.  So  as  we  move  through 
this,  establishing  what  those  institutional  checks  and  bal- 
ances will  be.  and  part — I  think  the  answer  to  that  one  in 
this  particular  instance  is  assuring  that  that  communication 
loop  is  very  open  and  that  there  is  resolution  to  each  of  the 
objectives  or  objections  heard  so  that  everybody  is  heard 
and  that  crisp  decisions  are  made  thereafter  in  terms  of  how 
to  serve  it  up  and  follow  through  from  there.  Once  you've 
heard  it,  your  follow-up? 

QUESTION:  Yes,  my  follow-up  is:  Do  you  need  the  flexi- 
bility to  deal  with  the  Russians,  contract  with  the  Russians, 
or  whatever,  to  give  you  this  time  so  that  you  have  the  sup- 
plies aboard  the  Station?  And  how  do  you  deal  with  your 
international  partners'  expectations  of  having  their  equip- 
ment aboard,  that  there's  commitments  made  even  above 
your  level  to  try  to  do  that  that  you  have  to  respond  to?  And 
I'm  wondering  how  you  deal  with  the  workforce,  but  also 
deal  with  that  issue. 

MR.  O'KEEFE:  That's  a  very  important  question  and  one 
that  we've  taken  extremely  seriously.  But  I'm  very,  very 
impressed,  with  the  response  of  our  international  partners 
and  their  capacity  to  really  act  like  partners  in  an 
International  Space  Station  effort.  This  is  an  endeavor  pur- 
sued by  16  nations,  and  they  have  responded  very,  very 
definitively.  So  in  working  through  all  those  issues,  as 
recently  as  a  month  ago  I  met  with  all  the  heads  of  agencies 
of  the  International  Space  Station  partnership,  and  we 
worked  through  all  of  the  challenges  that,  as  we  sort 
through  the  months  ahead  and  anticipate  return  to  flight, 
that  there  be  a  lot  of  obligations  and  commitments.  We're 
going  to  continue  to  look  to  them  and  to  us  to  honor  as  we 
work  through  this.  And  we  have — I've  got  a  very  clear 
understanding  with  them,  and  they  have  been  really  just 
exemplary  in  the  manner  in  which  they've  done  that.  So  I 
have — we've  all  taken  a  part  of  the  responsibility  of  this, 
and  we  all  view  this  as  a  partnership  challenge.  This  is  not 
something  which  they  say,  you  know,  to  the  United  States, 
"What  are  you  going  to  do  to  help  us  out  today?"  No. 
They've  been  very  forthcoming  in  terms  of  their  approach 
and  accepting  their  piece  of  the  partnership  responsibility 
in  doing  this.  It's  been  commendable. 

MR.  MAHONE:  We're  going  to  go  right  here. 

QUESTION:  Mr.  O'Keefe,  Peter  King,  with  CBS  News 
Radio.  Yesterday,  we  read  the  report,  of  course,  and  there 
were  lines  in  there  that  expressed  pessimism  that  NASA 
would  be  able  to  change,  and  in  an  interview  after  the 
report  was  issued.  Admiral  Gehman  told  my  colleague.  Bill 
Harwood,  that  some  are  or  will  be  in  denial  about  the 
changes  needed  and  the  flaws  in  the  system.  What  message 
have  you  or  will  you  send  to  those  particular  people  at 
NASA? 

MR.  O'KEEFE:  Well,  again,  and  this  is  reminiscent  of 
some  of  the  earlier  comments  that  we  have  shared  here,  this 
is  tough  stuff,  and  we  shouldn't  be  a  bit  surprised  when 


engineers,  and  technical  folks  and  all  of  the  rest  of  us  as 
colleagues  here  in  NASA  act  like  all  other  human  beings 
doing,  which  is,  when  you  hear  something,  it  really  is 
tough,  and  it's  hard  to  accept  that  it  takes  a  little  effort  to 
work  through  it.  And  that's  exactly  what  we've  been  really 
endeavoring  to  do  in  the  last  few  months  here  is  just  kind 
of  steeling  ourselves  for  what  we  asked  for,  which  was  an 
unvarnished  position,  a  very  direct  report,  take  off  the 
gloves  and  let  us  know  what's  wrong.  We  didn't  ask 
Admiral  Gehman  and  his  colleagues  to  tell  us  what's  so 
right  about  this  place.  I  mean,  that's  something  that  has, 
you  know,  again,  been  widely  viewed  as  "over-thought"  of. 
We  got  that  point.  The  issue  is  we  really  wanted  to  know, 
in  a  very  clear,  distinctive  way,  exactly  what  they  thought 
was  flawed  about  the  way  we  do  business,  what  caused  this 
accident,  what  were  the  contributing  factors,  all  of  the  other 
things  that  may  go  to  it,  and  they  complied  with  that,  and 
they  did  it  with  great  skill,  and  it  could — I  can't  imagine 
what  the  deliberations  among  the  Board  members  must 
have  been  over  these  past  several  months.  Trying  to  get  13 
very,  very  smart,  very  thoughtful,  very  Type  A  people  to 
come  to  closure  on  a  set  of  views  could  not  have  been  an 
easy  task.  And  you  can  see  that  they  really  worked  through 
some  very  differing  approaches  that  ultimately  came  to  a 
very  crisp  set  of  conclusions.  So  I  think  that's  something 
we've  got  to  work  through,  and  this  is  part  of  the  process 
we've  been  engaged  in  for  the  last  few  months  is  kind  of 
strapping  ourselves  in  for  the  fact  this  was  going  to  be  an 
unvarnished  view  and  a  very  clinical,  direct,  straightfor- 
ward position,  and  it  has  been.  We  got  what  we  asked  for, 
and  there's  no  question  that  we  now  need  to  go  about  the 
process  of  all  of  the  steps  that  it  takes  in  order  to  accept 
those  findings  and  to  comply  with  those  recommendations, 
and  that's  a  commitment  we're  not  going  to  back  off  of. 

QUESTION:  Todd  Halvorson  of  Florida  Today.  Now  that 
you  have  had  the  CRIB  report  for  25  hours,  and  given  the 
fact  that  you've  gotten  a  good  head  start  on  your  retum-to- 
flight  activities,  what  are  your  thoughts  now  about  your 
ability  to  make  that  March  through  April  window  for  return 
to  flight  next  year,  and  what  are  your  thoughts  about  when 
you  can  get  to  core  complete? 

MR.  O'KEEFE:  Well,  the  answer  to  both  is  we'll  see.  From 
the  technical  hardware  standpoint,  all  of  the  assessments 
we've  gone  through  here  in  the  last  couple  three  months  are 
there  are  a  number  of  options  that  would  certainly  permit 
an  opportunity  after  the  new  year  to  look  at  a  retum-to- 
flight  set  of  objectives,  and  we've  reviewed  those  with  the 
Board.  They're  aware  of  that  activity,  and  that's  underway. 
The  larger  questions  I  think  that  are  raised  in  this  report, 
too,  that  deal  with  some  of  the  management  systems,  the 
processes,  the  procedures,  the,  again,  the  culture  of  how  we 
do  business,  we  really  have  to  set  this  bar  higher  than  what 
they  did,  what  anybody  would  do.  The  standards  that  we 
are  expecting  of  ourselves,  we  need  to  be  our  toughest  crit- 
ics on  that.  And  so  those  are  going  to  be  a  little  more  diffi- 
cult to  I  think  assess  in  terms  of  a  calendar  or  a  time  line, 
in  terms  of  when  they're  done,  and  instead  I  think  it's  going 
to  be  a  case  where,  when  we've  made  the  judgment  that  we 
are  fit  to  fly,  that's  when  it's  going  to  occur. 
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Now.  we're  not  going  to  just  do  this  in  isolation  or  a  vacu- 
um. We've  asked  a  very  impressive  group  of  27  folks  who 
are  part  of  the  Tom  Stafford  and  Dick  Covey's  Return-to- 
Flight  Task  Group  to  help  us  work  through  those  options 
and  assure  that  we're  not  just,  you  know,  drinking  our  own 
bath  water  on  this  or  singing  ourselves  to  sleep  on  the 
options  we  love  the  most,  you  know.  It's  a  case  where  we 
really  want  to  lay  out  the  full  range  of  things  we're  going 
to  do  and  have  their  assessment  of  whether  they  think  that 
passes  the  sanity  check.  And  that  group  of  folks,  I  would 
suggest  to  you.  if  you  haven't  had  the  opportunity  to  do  so, 
to  look  at  the  varied  backgrounds  that  those  27  people 
bring,  not  only  the  technical  and  engineering  and  I  think 
smart  folks  on  the  hard  sciences  side,  but  also  a  lot  of  man- 
agement experts,  a  lot  of  folks  who  have  dealt  with  large 
organizations,  dealt  with  culture  change.  Walter  Broadnax, 
who  was  the  deputy  secretary  in  the  last  administration  for 
the  Health  and  Human  Services,  is  a  member  of  that.  He  is 
now  the  president  of  Clark  Atlanta  University.  This  is  a  guy 
who  has  been  through  several  different  organizational 
shifts  working  for  the  State  of  New  York,  working  for  the 
last  administration  at  HHS,  and  so  forth,  dealing  with  very 
large  organizations,  understanding  management  culture 
change  requirements.  Richard  Danzig,  who  was  the  last 
Secretary  of  the  Navy  in  the  last  administration,  as  well, 
was  a  member  of  this.  Ron  Fogleman.  who  was  the  Chief 
of  Staff  of  the  Air  Force,  who  really  set  some  standards  in 
the  Khobar  Tower  incident  over  what  accountability  stan- 
dards should  be  adhered  to  within  the  Air  Force,  is  a  mem- 
ber of  this  group.  So  if  you  work  through  every  one  of 
those,  what  you  find  are  folks  that  aren't  just — or  I  should- 
n't say  "just" — it's  not  dominated  by  a  group  of  folks  look- 
ing strictly  at  the  engineering-hardware  kinds  of  chal- 
lenges. It's  also  looking  at  these  larger  systems  process 
changes,  and  those  are  the  kind  of  folks  that  have  been 
added  to  this,  including  a  number  of  academics  who  have 
written  about  it,  and  thought  about  it,  and  worked  through 
it  like  Dr.  Vaughn  and  others,  colleagues  of  hers,  who  have 
really  looked  at  organization  change  issues  and,  in  turn,  are 
going  the  help  us  really  think  through  this.  And  they've 
been  there,  done  that,  gotten  several  T-shirts  and  recog- 
nized lots  of  tendencies  on  the  part  of  organizations  or 
institutions  to  select  options  that  may  or  may  not  be  more 
or  less  convenient.  They're  going  to  be  good  sanity  check- 
ers as  we  work  through  that,  and  those  are  the  kinds  of  peo- 
ple I  think  that  their  judgment  will  be  invaluable  as  we 
work  up  to  that  inevitable  retum-to-flight  milestone. 

MR.  MAHONE:  And  the  complete  list  of  those  members 
are  at  www.nasa.gov.  You  can  go  to  that  and  find  their  bios 
and  so  forth.  A  question  right  here. 

QUESTION:  Jim  Oberg  with  NBC.  I'd  like  to  ask  a  ques- 
tion on  culture  and  the  issues  of  intellectual  isolation  of  the 
NASA  community  from  the  outside  world.  The  Board  and 
other  people  have  mentioned  words,  from  the  Board  exam- 
ple, self-deception,  introversion,  diminished  curiosity 
about  the  outside  world,  NASA's  history  of  ignoring  exter- 
nal recommendations.  These  are  some  pretty  serious 
charges,  and  people  have  seen  evidence  of  it.  The  Board  did 
and  other  people  have  mentioned  it,  too.  You  have  a  situa- 
tion where  people  who  are  here  now  are  almost  hunkering 


down  into  a  siege  mentality,  where  outside  critics  are  cold 
and  timid  souls  whose  views  should  be  ignored.  How  can 
you  get  the  people  to  become  what  the  Board  wants  you  to 
be,  a  learning  organization  like  that,  when  many  of  the 
same  people  who  have  been  immersed  in  this  culture  for  all 
of  their  working  lives  are  the  ones  designing,  developing 
and  judging  the  success  of  your  recovery  process? 

MR.  O'KEEFE:  Again,  you  have  accurately  recited  what 
are  the  findings  of  the  Board  and  their  overarching  view  of 
what  they  have  deemed  or  viewed  to  be  the  culture  within 
the  agency.  The  first  step  in  any  process  is  to  accept  the 
findings  and  to  comply  with  those  recommendations,  and  I 
think  Admiral  Gehman  had  been  very  fond  of  saying  to  the 
Board.  "T  equals  zero,"  zero  meaning  anything  that  hap- 
pened after  February  1st  is  not  something  they're  looking 
at.  They're  really  focused  on  examining  that.  Well,  to 
NASA  today,  T  equals  zero  starts  today,  and  we've  really 
got  to  work  our  way  through  accepting  those  findings  and 
complying  with  those  recommendations  and  that  will  be 
the  beginnings  I  think  of  sorting  our  way  through  these 
larger  institutional  challenges.  I  think  the  questions  and 
comments  and  observations  made  by  your  colleagues  here, 
as  well  as  in  my  statements  at  the  opening  of  this,  suggest 
we've  got  to  being  that  process  and  work  with  what  is  a 
very  professional  group  of  folks  throughout  this  agency, 
who  I  think  can  step  up  and  accept  those  responsibilities, 
and  we  all  have,  in  working  through  this,  and  recognizing 
that  this  is  a  institutional  set  of  failures  that  must  be 
addressed.  I  don't  see  that  the  reticence  on  the  part  of  any 
individual  in  this  agency  is  going  to  be  a  setback  in  that 
regard.  We've  just  got  to  work  through  that  very  methodi- 
cally, very  deliberately,  very  consistently,  and  employing  a 
principle  of  the  United  States  Marine  Corps  that  I  always 
found  to  be  pretty  pointed,  which  is  "repeated  rhythmic 
insult."  If  you  always  say  the  same  thing,  and  you  mean  it, 
and  you  keep  going  at  it,  and  you  stick  with  that  set  of  prin- 
ciples and  values  and  discipline,  it's  going  to  resonate  in 
time,  and  in  time  means  sooner  rather  than  later  in  order  for 
us  to  really  reconcile  and  come  to  grips  with  these  findings, 
and  accept  them,  and  comply  with  those  recommendations. 

MR.  MAHONE:  Question,  here. 

QUESTION:  Bill  Glanz,  Washington  Times.  I  just  want  to 
find  out  what  your  gut  reaction  was  while  you  were  read- 
ing that  part.  For  instance,  were  you  appalled  at  some  of  the 
decisions  that  the  program  managers  made,  and  also,  when 
you  were  reading  it,  did  you  have  any  "holy  crap" 
moments?  [Laughter.] 

MR.  O'KEEFE:  I've  had  so  many  of  those  since  February 
1st  I  can't  count  them  all  any  more.  Again,  this  was  not  a 
surprise.  Among  the  emotions  that  I  felt  in  reading  through 
this,  surprise  was  not  among  them,  because  again,  they 
were  very  faithful  in  what  they  said  they  would  do.  Admiral 
Gehman  and  every  member  of  that  Board  were  very,  very 
clear  in  the  course  of  their  proceedings  of  saying,  "What 
we're  telling  you  and  what  we're  inquiring  about  in  these 
public  hearings  is  what  you  will  read  in  this  report."  Very 
explicit  about  that.  They  never  walked  away  from  that 
point.  Again,  talking  about  repeated  rhythmic  insult,  that 


COLUMBIA 

SUPPLEMENTAL    MATERIAL 


was,  a  repetitive  commentary  that  they  followed  through  on 
and  did  precisely  what  they  said  they  were  going  to  do.  So 
in  reading  through  this,  and  again,  our  approach  from  day 
one,  from  the  1st  of  February  on,  was  again  to  be  as  open 
as  we  possibly  could  conceive  of  being,  release  all  of  the 
information  for  everybody  to  see  what  was  going  on.  So 
reading  lots  of  the  discourse  and  back  and  forthing  and 
communication  that  went  on  that  are  now  faithfully  repeat- 
ed in  the  report,  was  not  the  first  time  I'd  read  them, 
because  we  released  them  a  lot  here,  and  they  talked  about 
them  a  lot  in  the  hearings,  and  so  in  the  course  of  this,  I 
think  the  terminology  they  used  was  very  consistent  with 
what  I  heard  in  the  course  of  all  those  public  hearings.  And 
after  22,  23  hearings  that  lasted  on  average  three-and-a-half 
to  four  hours  each,  that  was  a  lot  of  volume.  So  really,  dis- 
tilling all  of  that  and  coming  up  with  a  report  that  was  as 
succinct  as  this  is,  that  it  was  only  248  pages  by  compari- 
son to  the  thousands  of  pages  of  transcripts  from  all  those 
hearings,  was  really  the  part  that  I  found  most  impressive, 
was  they  were  able  to  distill  this  into  a  very  pointed  set  of 
findings  and  recommendations.  But  surprise  was  not 
among  them,  and  there  was  nothing  that  I  saw  there  that 
they  had  not  previously  talked  about.  They  were  very,  very 
conscientious  about  following  through  on  that  commitment 
and  they  did  what  they  said  they  were  going  to  do. 

QUESTION:  [Off  microphone]  —  appalled  by  some  of  the 
decisions  that  the  program  managers  made,  you  know, 
being  pressured  by  the  long  schedule,  and  all  the  missed 
opportunities  that  they  mentioned  in  the  report? 

MR.  O'KEEFE:  Again,  I  mean  the  course  of  this.  There 
have  been  countless  hearings  that  I've  been  a  witness  at. 
There  have  been  lots  of  different  opportunities  where  we 
have  gotten  together  among  your  colleagues  in  the  press 
corps  to  discuss  several  of  the  events  as  we've  walked 
through  this  in  the  last  seven  months.  At  each  one  of  those 
there  were  plenty  of  cases  in  which  you  said,  gosh,  how 
could  this  have  happened?  But  there's  no  question.  None  of 
it  was  a  new  revelation  in  that  regard.  It  has  been  all  by 
degrees  over  time  in  these  last  six,  seven  months,  you 
know,  rolling  out  and  laying  out  in  ways  that  we  have  real- 
ly seen  institutionally  as  well  as  with  the  hardware,  as  well 
as  human  failures  were  that  led  to  this.  By  all  means,  they 
are  a  guidepost  to  figuring  out  exactly  how  you  improve 
that  communicate  net,  sharpen  the  decision-making 
process  that  informs,  decision-making  that  includes  all  the 
information  that's  necessary  to  make  those  kinds  of  judg- 
ments at  the  time,  and  I  think  that's  exactly  what  we  saw 
come  out  of  this. 

QUESTION:  Chris  Stolnich  from  Bloomberg  News.  I  was 
just  wondering  if  you  could  describe  what  you  believe  the 
goals  for  manned  space  flight  are  in  the  wake  of  this  report, 
and  how  or  if  they  should  change? 

MR.  O'KEEFE:  We  are,  and  have  always  been,  dedicated 
to  exploration  objectives  which  in  some  instances  require  a 
multitude  of  different  capabilities,  to  include  human  inter- 
vention. What  we've  laid  out  is  a  strategy,  a  stepping  stone 
approach  in  which  we  conquer  each  of  the  technical  and 
technology  limitations  as  we  pursue  greater  opportunities. 


Calls  for  a  sequence  of  capabilities,  which  we  see  playin; 
out  right  now.  In  early  January  we're  going  to  see  two 
Rovers  land  on  the  planet  Mars,  and  it  will  follow,  as  it  did, 
several  other  missions  that  preceded  this,  in  order  to  colled 
and  gather  the  information  and  the  knowledge  necessary  to 
inform  the  opportunity  for  human  exploration  at  some 
point.  And  as  we  prepare  those  capabilities  to  proceed,  we 
have  a  more  complete  knowledge  of  precisely  what  it  is 
we're  going  to  encounter,  and  what  will  be  garnered  am 
gathered  from  that  set  of  missions  and  those  that  will  fol 
low,  which  are  robotic,  will  inform  that  decision  makin; 
and  inform  that  understanding  and  judgment  about  exacti] 
how  human  exploration  thereafter  could  be  permissible 
The  second  phase  of  it  though  is  an  important  one,  becaus 
your  question  I  think  also  speaks  to  the  immediacy  o 
instances  and  cases  in  which  human  involvement  is  imper 
ative  in  order  to  preserve  capacity. 


Today  there's  a  spirit  of  debate  that's  going  on,  that  again 
I  commend  you  all  for  having  covered  rather  broadly,  o 
exactly  what  is  going  to  be  the  service  life  of  the  Hubble 
telescope.  Just  launched  on  Monday  the  SIRTF  infrared  tel- 
escope that  will  be  a  companion  to  Hubble,  if  you  will,  foi 
all  the  infrared  lower  temperature  observations  and  read- 
ings that  could  be  observed  by  that  imagery.  But  recall  thai 
the  history  of  Hubble — which  I  have  not  seen  very  exten- 
sively discussed  in  all  the  coverage  of  the  current  debate 
about  how  long  Hubble  should  be  operational  and  whal 
servicing  missions  are  necessary — the  history  of  that  was 
your  predecessors  10  years  ago  roundly  viewed  the  deploy- 
ment of  that  capability  as  a  piece  of  $1  billion  space  junk 
because  it  couldn't  see.  The  lens  needed  correction.  Il 
required  a  Lasik-equivalent  surgery.  And  the  only  way  thai 
could  be  done  was  by  human  intervention.  So  in  1993  wher 
that  mission  was  launched  to  correct  the  Hubble,  that  was 
done  successfully,  and  the  only  way  it  could  be  done  was 
because  a  human  being,  several  of  them,  spent  many,  manj 
months  training  to  be  prepared  for  making  those  correc- 
tions on  the  spot,  and  for  every  contingency  that  could  arise 
as  you  work  through  it.  It  was  nothing  we  could  do,  adjusi 
from  the  ground.  The  last  round  trip  flight  of  the  Columbia 
in  March  of  2002  was  to  the  Hubble  again  to  service  it,  to~ 
install  new  gyros,  to  install  an  infrared  camera,  to  upgrade 
a  number  of  different  factors  to  it  that  improved  its  capaci- 
ty by  a  factor  of  10,  according  to  all  the  astronomers  who 
observed  this,  and  they  are  just  elated  over  the  quality  of 
what  has  come  back  from  this.  And  yet  it  turned  out  that  the 
primary  human  characteristic  that  was  so  important  on  that 
mission  was  embodied  by  a  gent  who  will  be  joining  us 
here  in  about  a  month,  or  a  matter  of  fact,  weeks — I'm  los- 
ing track  of  days  here — Dr.  John  Grunsfeld,  who  will  be 
our  Chief  Scientist,  and  relieving  Dr.  Shannon  Lucid,  as 
she  goes  back  to  Johnson  Space  Center,  as  our  Chief 
Scientist.  He  was  on  that  mission.  He"s  an  astrophysicist, 
got  all  kinds  of  incredible  scientific  background.  But  his 
primary  human  characteristic  trait  that  was  most  valuable 
proved  to  be  that  all  the  instruments  for  adjustment  on  the 
Hubble  telescope  are  on  the  left-hand  side. 

So  rather  than  having,  like  many  of  us — righties  are  stuck 
with  the  problem  or  reaching  around  the  front  of  your  face 
with  a  catcher's  mitt  equivalent  capacity  to  adjust  things, 
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and  a  big  bubble  over  year  head,  trying  to  see  what's  going 
on — his  primary  human  characteristic  that  was  most  valu- 
able is  he's  a  lefty.  He's  now  referred  to  as  "the  southpaw 
savant."  But  it  was  a  human  characteristic  that  made  those 
adjustments,  that  made  that  capacity  work  in  a  way  that  we 
never  imagined  possible,  and  that  10  years  ago  we  were 
prepared  to  write  off  as  garbage.  And  instead  today,  it's  rev- 
olutionizing not  only  the  field  of  astronomy,  but  also 
infonning  all  of  us  as  human  beings  of  the  origins  of  this 
universe,  its  progression  over  time.  It  has  changed  the  way 
we  look  at  everything.  In  the  last  18  months  it  has  been  a 
remarkable  set  of  discoveries  that  have  emerged  from  that 
capability  that  would  never  have  been  possible  were  it  not 
for  human  intervention.  So  those  are  the  two  areas  we  real- 
ly have  to  focus  on,  is  recognizing  how  we  can  advance  the 
exploration  opportunities  by  being  informed  as  deeply  as 
we  can  through  a  stepping-stone  approach  of  always  devel- 
oping those  capabilities  and  technologies  that  then  permits 
the  maximum  opportunity  for  human  involvement,  and 
then  in  those  cases  in  which  nothing  else  will  do  than 
human  intervention  and  cognitive  judgment  and  determina- 
tion, and  making  selections  that  only  humans  can  do,  where 
do  you  use  those  judiciously  in  order  to  avoid  the  unneces- 
sary risk  that's  attendant  to  space  flight  for  only  those  pur- 
poses and  causes  that  are  of  greatest  gain. 

MR.  MAHONE:  Riaht  here. 


kinds  of  leaders  who  very  clearly  understand,  they  get  it, 
that  this  is  about  institutional  change.  Those  are  the  folks 
that  I  fully  anticipate  are  going  to  be  the  ones  who  will  be 
the  folks  who  will  cany  this  out  and  accomplish  the  objec- 
tives we  talked  about  here  today,  and  they  in  turn  select 
those  managers,  engineers,  technical  folks  who  share  that 
same  ethos.  So  as  we  work  through  this  we've  got  to  be 
very,  very  deliberate  in  relying  on  the  judgment  of  individ- 
uals who  have  committed  to  those  objectives.  And  I  encour- 
age you  to  just  kind  of  scan  through  the  senior  leadership 
as  well  as  the  senior  positions  here  throughout  the  agency 
that  have  been  conducted,  and  you'll  find  a  rather  signifi- 
cant new  management  team  in  those  capacities,  new  lead- 
ership team,  and  all  of  them  share  the  view  that  I've  just 
talked  about  here,  which  is  this  is  an  institutional  challenge 
which  is  greater  than  any  one  of  us  individually  or  even 
collectively.  It's  about  the  longer-term  values,  discipline 
and  principles  that  this  agency  should  adhere  to,  and  they 
share  those  goals  and  views. 

MR.  MAHONE:  Last  question. 

QUESTION:  Steven  Young  with  SpaceFlightNow.com. 
I'm  wondering  if  you've  actually  read  the  report  cover  to 
cover,  or  whether  you  intend  to  do  that,  and  whether  you 
would  make  it  required  reading  for  NASA  employees  and 
contractors? 


QUESTION:  David  Chandler  with  New  Scientist 
Magazine.  One  thing  that  the  Board  explicitly  avoided  talk- 
ing about,  not  because  they  didn't  think  it  was  important 
but  because  they  didn't  see  it  as  their  role  to  do,  was  issues 
of  personal  accountability.  I'm  wondering  what  your 
thoughts  are  on  whether  it  is  your  role,  and  for  example, 
people  within  the  agency  who  failed  to  follow  NASA's  own 
rules.  What  kind  of  a  message  about  the  importance  of 
safety  will  be  sent  if  there  is  no  personal  accountability  or 
personal  consequences  for  people  who  didn't  follow  your 
own  rules  in  this  mission? 

MR.  O'KEEFE:  Well,  first  and  foremost,  I  am  personally 
accountable,  myself,  for  all  the  activities  of  this  agency.  I 
take  that  as  a  responsibility  and  I  do  not  equivocate  on  that 
point.  I  think  it  is  absolutely  imperative  that  we  all  view  our 
responsibilities,  and  that  one  is  mine.  The  approach  I  think 
that  is  absolutely  imperative  to  follow  through  with  in  this 
institutional  change  that  we've  talked  about  here,  and  had 
lots  of  different  comments  and  observations  about,  that  the 
report  covers  in  depth,  is  that  you  must  select  folks  in  lead- 
ership and  senior  management  capacities  who  understand 
exactly  what  that  set  of  institutional  change  requirements 
are.  So  rather  than  saying  I'm  going  to  remove  so-and-so. 
it's  more  a  case  of,  I  need  to  appoint  folks  who  understand 
that.  At  this  juncture  of  the  four  space  flight  centers  that 
have  any  specific  activity  over  Shuttle  operations. 
International  Space  Station,  et  cetera,  so  among  the  10  cen- 
ters there  are  four  that  specifically  and  uniquely  deal  with 
space  fiight  operations.  The  longest-serving  tenure  center 
director  was  appointed  in  April  of  2002.  He  is  now  the 
elder  statesman  among  them.  The  rest  have  been  appointed 
since.  And  those  are  the  folks  who  are,  in  my  judgment,  the 


MR.  O'KEEFE:  I  think  I  don't  need  to  direct  that  it  be 
required  reading.  I  haven't  run  into  anybody  in  this  agency, 
any  colleague  in  the  organization  who  have  not  felt  that  this 
is  something  they  want  to  read  in  its  fullness.  So  I  think  no 
amount  of  direction  from  me  is  going  to  make  a  difference. 
People  are  doing  it  because  they  view  that  as  a  responsibil- 
ity, that  we  all  need  to  view  this  is  a  responsibility  that  all 
of  us  must  carry.  I  have  read  through  it  as  of — again,  it  was 
a  long  day  yesterday,  but  I  started  when  Admiral  Gehman 
dropped  it  off  at  10  o'clock  yesterday  morning,  so  I  had 
about  a  one  hour  head  start  from  his  press  conference.  And 
again,  what  I  found  in  reading  through  it  was  that  it  remark- 
ably patterns  exactly  what  they  said  in  all  their  public  state- 
ments. So  in  many  respects  I  was  reading  the  same  things 
I've  been  hearing,  in  listening  to  those  public  hearings,  lis- 
tening to  their  public  comments.  I've  got  to  go  back  this 
weekend  and  read  every  single  word  for  its  content  to  do 
that  right,  but  in  reading  through  it  briskly,  as  of  yesterday 
morning  and  then  last  night  after  we  left  them,  after  a  long 
session  with  them,  had  a  chance  for  several  hours  to  read 
through  it  again.  But  again,  it  struck  me  immediately  as 
being  remarkably  close  and  right  on  to  what  it  is  they've 
been  saying.  So  there  were  no  surprises  in  that  regard.  But 
this  weekend,  you  bet,  word  for  word,  from  the  first  page 
to  the  last  word  on  page  248  is  what  I  intend  to  read.  I  don't 
need  to  instruct  that  anybody  in  the  agency  do  that.  I'll  bet 
everybody  is,  because  I  think  this  is  the  sense  of  responsi- 
bility we  all  need  to  share,  and  I  think  that  doesn't  need  to 
be  directed  by  anybody. 

MR.  MAHONE:  Mr.  Administrator,  thank  you  very  much, 
and  thank  all  of  you  for  being  here  today.  [Whereupon,  at 
12:31  p.m.,  the  press  briefing  was  concluded.] 
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